21–30 of 71 posts
Slightly off topic, but how are people using SSL with App Engine? Last time I checked they didn't support SSL on your own domain. I'm not sure if this is similar for e.g. Heroku. I presume most non-trivial apps would have some kind of secure login.
[1]http://googleappengine.blogspot.com/2011/10/app-engine-ssl-f...
StartSSL.com offers free yearly simple SSL certificates, and are supported by all major browsers. If you want higher-grade, you'll have to pay. They're very open about wanting to provide free simple certificates for everyone.
Re: StartSSL see http://www.belshe.com/2012/02/04/rethinking-ssl-for-mobile-a...
I can imagine the SSL cert sellers laughing at those buying them. How is it that money can BUY TRUST is beyond my comprehension.
If you just want to secure a login page for your own personal use, get a free cert from StartSSL.
If you need to give access to the page to more people, it's best to get a cheap cert from Comodo, etc. because they're compatible with more mobile devices. Don't spend more than $15
If you intend on selling something from the site, I'd recommend getting some form of company validation on top of the standard domain validation which is performed when buying cheaper certs. GeoTrust, Comodo, Globalsign, etc. can help. It should cost less than $100.
The best certs to get to re-assure your customers are the EV ones. No need to go full Verisign and waste ton of money on them, you can get them cheap-ish from Globalsign, Comodo and Geotrust resellers.
If you're getting a cert generated by an established certificate authority, it doesn't really matter who you buy it from. Aim for the best price for the level of support that you want to get.
Earlier quoted context omitted.
Is there a chance you could elaborate on this some? What would some example "bells and whistles" be with regards to SSL certs?
Verisign EV certs get the green text along with the name of the company in the browser (ex: https://paypal.com ) More information: http://www.verisign.com/ssl/ssl-information-center/extended-...
In general, no one should ever do business with Verisign, due to their practice of domain slamming, their Site Finder misfeature, and other shady practices.
Side question: what's the best company for SSL certificates where you're hosting multiple distinct domains for various clients on the same server? I've read about SAN certs, but I haven't found any documentation ...
Side question: what's the best company for SSL certificates where you're hosting multiple distinct domains for various clients on the same server? I've read about SAN certs, but I haven't found any documentation ...
The downside seems that the organization/country/city fields must be the same but that doesn't show unless you use EV The upside is no painful IP acquisition, CSR and renewal process.
When you care about your cert (validated, EV, etc): DigiCert. When you don't care that much: RapidSSL from Namecheap.
The end.