Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What's the best company to buy SSL certificates from?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 71 posts

Re: Ask HN: What's the best company to buy SSL certificates from?

#41

Post by RyanMcGreal »

JoachimSchipper wrote: post #39
RyanMcGreal wrote: post #32

Earlier quoted context omitted.

What's the difference between a simple certificate and something higher-grade? What does the simple certificate lack that a higher grade certificate provides?

Extended verification certificates (EV; "actually verified") cause the browser bar to turn green. That will make people more likely to trust you.

Thanks for clarifying!

Will a free StartSSL certificate trigger an 'untrusted source' warning from the browser?

Also, will a free certificate be adequate for encrypting authentication data in a web API?

Re: Ask HN: What's the best company to buy SSL certificates from?

#42

Post by forgotusername »

maaku wrote: post #24
_urga wrote: post #20

Earlier quoted context omitted.

Re: StartSSL see http://www.belshe.com/2012/02/04/rethinking-ssl-for-mobile-a...

That's disingenuous. You should be bundling your CA cert with your cert anyway, which would avoid that problem.

Neither the linked article nor any of the parent comments talk about certificate chaining, which seems to be what you're referring to.

Also, please check the definition of 'disingenuous', it's massively overused on Hacker News (often in a completely incorrect context).

Re: Ask HN: What's the best company to buy SSL certificates from?

#43

Post by JoachimSchipper »

RyanMcGreal wrote: post #41
JoachimSchipper wrote: post #39

Earlier quoted context omitted.

Extended verification certificates (EV; "actually verified") cause the browser bar to turn green. That will make people more likely to trust you.

Thanks for clarifying! Will a free StartSSL certificate trigger an 'untrusted source' warning from the browser? Also, will a free certificate be adequate for encrypting authentication data in a web API?

StartSSL is completely fine for those goals. Pretty much the only effect of an EV certificate is the green bar. (Which is easily worth $150/yr if you're doing millions in e-commerce, of course!)

Re: Ask HN: What's the best company to buy SSL certificates from?

#44

Post by jd »

conanite wrote: post #22

Side question: what's the best company for SSL certificates where you're hosting multiple distinct domains for various clients on the same server? I've read about SAN certs, but I haven't found any documentation ...

As far I know the only thing that works reliably is to get multiple IPs and multiple (wildcard) SSL certificates. You can try to save a little money by getting startssl certificates (free) or by using SSL host headers (multiple SSL on one IP address), but it doesn't work on all browsers so you end up wasting time explaining to your customers why they get an error when they access their site.

Re: Ask HN: What's the best company to buy SSL certificates from?

#45

Post by agwa »

charliesome wrote: post #3

I like Gandi. You get a free SSL certificate for a year with your domain, and it's $12 a year after that.

They say you also get a free 1-year certificate with domain name renewals, implying that if you renew your domains for 1 year you can get a perpetual stream of free certs.

Re: Ask HN: What's the best company to buy SSL certificates from?

#47

Post by rickard »

jd wrote: post #44
conanite wrote: post #22

Side question: what's the best company for SSL certificates where you're hosting multiple distinct domains for various clients on the same server? I've read about SAN certs, but I haven't found any documentation ...

As far I know the only thing that works reliably is to get multiple IPs and multiple (wildcard) SSL certificates. You can try to save a little money by getting startssl certificates (free) or by using SSL host headers (multiple SSL on one IP address), but it doesn't work on all browsers so you end up wasting time explaining to your customers why they get an error when they access their site.

What is "SSL host headers"? Is it wildcard certs, as Microsoft describes them on http://www.microsoft.com/technet/prodtechnol/WindowsServer20... ?

Re: Ask HN: What's the best company to buy SSL certificates from?

#48

Post by RyanMcGreal »

JoachimSchipper wrote: post #43
RyanMcGreal wrote: post #41

Earlier quoted context omitted.

Thanks for clarifying! Will a free StartSSL certificate trigger an 'untrusted source' warning from the browser? Also, will a free certificate be adequate for encrypting authentication data in a web API?

StartSSL is completely fine for those goals. Pretty much the only effect of an EV certificate is the green bar. (Which is easily worth $150/yr if you're doing millions in e-commerce, of course!)

Excellent - thank you!

Re: Ask HN: What's the best company to buy SSL certificates from?

#49

Post by _urga »

nicksuan wrote: post #33
_urga wrote: post #20

Earlier quoted context omitted.

Re: StartSSL see http://www.belshe.com/2012/02/04/rethinking-ssl-for-mobile-a...

Some of those numbers don't look correct at all. For example I can't find any host name that takes longer than ~500ms to do DNS resolution over 3G. (That's almost worst case scenario, where everything except the TLD is uncached.)

Mike Belshe the author of that post is one of the developers of Chrome as far as I know.

Re: Ask HN: What's the best company to buy SSL certificates from?

#50

Post by zumda »

rickard wrote: post #47
jd wrote: post #44

Earlier quoted context omitted.

As far I know the only thing that works reliably is to get multiple IPs and multiple (wildcard) SSL certificates. You can try to save a little money by getting startssl certificates (free) or by using SSL host headers (multiple SSL on one IP address), but it doesn't work on all browsers so you end up wasting time explaining to your customers why they get an error when they access their site.

What is "SSL host headers"? Is it wildcard certs, as Microsoft describes them on http://www.microsoft.com/technet/prodtechnol/WindowsServer20... ?

I think he meant "Server Name Indication" https://en.wikipedia.org/wiki/Server_Name_Indication

If there is more than one site hosted on a single IP, the client sends a request for the SSL certificate. In the "old" way, the client didn't say to which domain it wants to connect (it only told that after the SSL connection was established), so the server didn't know which certificate to send.

The problem has been solved with SNI, but it isn't universally supported (yet), though we are close (namely IE on XP). With SNI the client basically sends the server to which domain it wants to open a secure connection, so the server can serve the correct certificate.

Post reply on HN