Ask HN: What's the best company to buy an SSL certificate from?

#1

Post by petecooper » Sat, Sep 20, 2014, 10:57 AM UTC

I am embarking on an upcoming Magento e-commerce project, target demographic is security-aware business customers. The extended validation (green bar) SSL is -- in my view -- required for the website.

There was an Ask HN thread [1] from nearly three years ago that asked the same question, and a variety of answers were provided. On the one hand, there's the "don't spend more than x" on a certificate, and there's the flip side of "get a green bar, it's worth it".

The specifics:

- site is running atop Magento 1.9 on LAMP, payments processed offsite by Braintree (i.e., no credit card details stored on the website) - initially 1x IP address, hosted from a UK data centre - static components may be served from a non-www subdomain (i.e., static.example.com) in future, which may be the same or different IP address

My questions:

1. Who's worth shortlisting in 2014? 2. If you consider yourself a security-aware shopper, would you be dissuaded from purchasing from a site with standard (`non-green`, if you will) SSL?

Thank you in advance.

[1] https://news.ycombinator.com/item?id=3556796

Re: Ask HN: What's the best company to buy an SSL certificate from?

#2

Post by avinassh » Sat, Sep 20, 2014, 11:10 AM UTC

1. Namecheap according to me.

2. Yes.

Re: Ask HN: What's the best company to buy an SSL certificate from?

#3

Post by asaddhamani » Sat, Sep 20, 2014, 11:15 AM UTC

1. SSLS.com is rather nice.

2. Yes.

Re: Ask HN: What's the best company to buy an SSL certificate from?

#4

Post by AdamGibbins » Sat, Sep 20, 2014, 1:21 PM UTC

1. DigiCert. They're not the cheapest, but they really have their stuff together. Their support is awesome (speedy, technically competent, and human). They're also proactive about identifying issues with your certs, they handled the heartbleed incident perfectly - reissued for free with no issues.

2. No

Re: Ask HN: What's the best company to buy an SSL certificate from?

#5

Post by thesimon » Sat, Sep 20, 2014, 1:22 PM UTC

1. In terms of pricing, https://www.gogetssl.com seems good. I haven't used it personally, but $27.85 for an EV in the first year seems quite nice. Namecheap is good, too, but a bit more expensive.

2. Yes

Re: Ask HN: What's the best company to buy an SSL certificate from?

#6

Post by minhdanh72 » Sat, Sep 20, 2014, 1:25 PM UTC

1. cheapsslsecurity.com 2. Yes

Re: Ask HN: What's the best company to buy an SSL certificate from?

#7

Post by Spooky23 » Sat, Sep 20, 2014, 1:26 PM UTC

AdamGibbins wrote: post #4

1. DigiCert. They're not the cheapest, but they really have their stuff together. Their support is awesome (speedy, technically competent, and human). They're also proactive about identifying issues with your certs, they handled the heartbleed incident perfectly - reissued for free with no issues. 2. No

+1 for Digicert. They'll also reissue certs with new SANs if needed.

Re: Ask HN: What's the best company to buy an SSL certificate from?

#8

Post by madhurjain » Sat, Sep 20, 2014, 1:28 PM UTC

https://www.startssl.com

2 Years wildcard for $59.90

Re: Ask HN: What's the best company to buy an SSL certificate from?

#9

Post by thesimon » Sat, Sep 20, 2014, 1:30 PM UTC

madhurjain wrote: post #8

https://www.startssl.com 2 Years wildcard for $59.90

They charge for reissuing certs though. https://news.ycombinator.com/item?id=7557764

Re: Ask HN: What's the best company to buy an SSL certificate from?

#10

Post by ayrx » Sat, Sep 20, 2014, 1:33 PM UTC

Just to address point 2. No. Those who say yes probably do not understand what EV certs actually do.

You get the exact same level of security from EV and non-EV certs. The whole "extended validation" criteria is pretty handwavy and varies from CA to CA. Paying more for that warm, fuzzy feeling isn't worth it.