Live data from Hacker News

Ask HN: What's the best company to buy an SSL certificate from?

news.ycombinator.com

11–20 of 89 posts

Re: Ask HN: What's the best company to buy an SSL certificate from?

#11
Pick one that can deliver the full certificate chain without using SHA-1.

The faster the web moves away from SHA-1 the better, and rewarding companies that are already abstaining from SHA-1 contributes to our collective security, in the case of HTTPS.

You should also do it for purely selfish reasons. Chrome is sunsetting SHA-1 for use in certificate signatures, and Chrome will eventually show SHA-1 certificates as insecure. See the link below.

http://googleonlinesecurity.blogspot.se/2014/09/gradually-su...

Re: Ask HN: What's the best company to buy an SSL certificate from?

#12
Th problem with EV (green bar) certs is the Browser usually ends up checking the certificate status via CRL or OCSP (URI is specified in the cert), which can add an additional .5 to 10+ seconds before the page is displayed. More so when the CA servers are down or the connection times out.

So if you do go for an EV cert, go for the one that has the best listed uptime on it's CRL or OCSP servers.

Having said that, I would never spend more than $10 on a cert, and just use the most standard/common "bundled" CA cert. No one will ever know. It will have faster page loads. And those fake stories that EV certs increase conversions are exactly that, fake, and misleading. No one will real world experience has ever claimed to see a positive difference with EV certs.

The only problem with cheaper certs is you have to bundle the intermediary CA certs...

http://www.devside.net/wamp-server/installing-comodo-positiv...

Re: Ask HN: What's the best company to buy an SSL certificate from?

#14
post #11

Pick one that can deliver the full certificate chain without using SHA-1. The faster the web moves away from SHA-1 the better, and rewarding companies that are already abstaining from SHA-1 contributes to our collective security, in the case of HTTPS. You should also do it for purely selfish reasons. Chrome is sunsetting SHA-1 for use in certificate signatures, and Chrome will eventually show SHA-1 certificates as in…

More information about the support for SHA-2 certificates from various purchase avenues at: https://shaaaaaaaaaaaaa.com/#sha2-certificate

Re: Ask HN: What's the best company to buy an SSL certificate from?

#15
post #9

https://www.startssl.com 2 Years wildcard for $59.90

They charge for reissuing certs though. https://news.ycombinator.com/item?id=7557764

That's not a good reason to skip over them. Unless you expect multiple Heartbleed-severity bugs to be exposed in two years you are still way ahead. Just don't lose your private key.

Re: Ask HN: What's the best company to buy an SSL certificate from?

#16
post #5

1. In terms of pricing, https://www.gogetssl.com seems good. I haven't used it personally, but $27.85 for an EV in the first year seems quite nice. Namecheap is good, too, but a bit more expensive. 2. Yes

Where do you see an option for an EV at $27.85 on that site? I'm seeing prices that start at $110 a year for 2 years. https://www.gogetssl.com/extended-validation/

Re: Ask HN: What's the best company to buy an SSL certificate from?

#17
I honestly don't think it matter much where you buy your certificates. In the end it the same product, plus or minus some service you may of may not care about.

Should your certificate provider do something stupid you can switch to a new provider in 30 minutes, assuming you don't pick EV.

The EV certificates look good, but that's about it. They do come with at least two disadvantages:

1. If your company name is different from the domain name it's going to look weird. We dropped having a EV because we're not interested in having the name of our parent/holding company in the address bar.

2. If you later switch back to a regular SSL certificate is going to look suspicious to your regular customers.

That being said, we use Trustzone (http://www.trustzone.com). They provide GlobalSign SSL certificates at a reasonable price. I like that they email us, or call if we don't react, a few months before our certificates expire. We also have our own account manager who helps with new certificates and renewals. It's extremely nice just be able to call someone.

Re: Ask HN: What's the best company to buy an SSL certificate from?

#18

My startup is actually centered around this. If anyone wants to purchase a certificate through me, I'll happily give you the lowest rates I can. ($25 EV or $40 wildcard) Our homepage is https://certly.io , shoot me an email at ian@certly.io

What does your startup do?

How are you able to offer EV certificates so cheaply? I thought they were typically ~$1000.

Re: Ask HN: What's the best company to buy an SSL certificate from?

#19
post #10

Just to address point 2. No. Those who say yes probably do not understand what EV certs actually do. You get the exact same level of security from EV and non-EV certs. The whole "extended validation" criteria is pretty handwavy and varies from CA to CA. Paying more for that warm, fuzzy feeling isn't worth it.

Who are you to say that, for him, giving his customers a "warm fuzzy feeling" isn't worth paying a few hundred dollars? It could easily increase revenue far more than that.

Re: Ask HN: What's the best company to buy an SSL certificate from?

#20
post #11

Pick one that can deliver the full certificate chain without using SHA-1. The faster the web moves away from SHA-1 the better, and rewarding companies that are already abstaining from SHA-1 contributes to our collective security, in the case of HTTPS. You should also do it for purely selfish reasons. Chrome is sunsetting SHA-1 for use in certificate signatures, and Chrome will eventually show SHA-1 certificates as in…

You should also do it for purely selfish reasons. Chrome is sunsetting SHA-1 for use in certificate signatures, and Chrome will eventually show SHA-1 certificates as insecure.

Referring specifically to this point, and not to your wider point about moving away from SHA-1, "because one browser maker said so" is rarely a good reason to do anything.

Google has an irritating habit of deciding it knows best for the entire world, but often it gets that call wrong and winds up degrading the experience for people who aren't in its chosen group of blessed users. The Firefox team are similarly arrogant at times.

However, in the real world, large organisations also use browsers to access intranet sites, and their requirements -- particularly with regards to security -- may be different to users surfing the public Web. Developers do need to do things with sites that aren't fully configured yet or are in transition from one system to another even if those things might not be a good idea when surfing the public Web. And so on.

So, I urge you to support good practices by making solid technical arguments for them. For example, in this case you could explain or link to information about why the SHA-1 issue matters for those who don't know. Please don't promote browser makers as authoritative sources of best practices instead, because often they aren't.

Post reply on HN