I tried some time ago and didn't get the certificate or any email back, not worth the hassle to save $20 imho.
Don't submit to the SSL cert racket. You can get one for no charge
41–50 of 88 posts
Re: Don't submit to the SSL cert racket. You can get one for no charge
#42My understanding is free ones are not trusted/accepted by the browsers, hence to have something that isnt tossing errors at your users requires a small payment to a CA. I've used positivessl from namecheap whenever I need certs, its something crazy cheap like $5
My understanding is free ones are not trusted/accepted by the browsers
You might mean self-signed certificates?
Re: Don't submit to the SSL cert racket. You can get one for no charge
#43Re: Don't submit to the SSL cert racket. You can get one for no charge
#44Earlier quoted context omitted.
The best (in terms of browser compatibility) cheap cert that Namecheap sell is the RapidSSL cert at http://www.namecheap.com/ssl-certificates/geotrust-ssl-certi...
Be aware though that GeoTrust and Thawte certs don't work[1] on android devices. There are claims that it can be fixed by adding a cross-root cert[2] but for me that didn't work out. More generally: If you need to support mobile devices then read your CA's compatibility list closely (if you can find it...) and test, test, test. You'd think this shouldn't be an issue anymore in 2012, but it sadly still is. [1] http://…
Sigh. I spent way too much time picking these particular certs and they've gone and messed it up. :)
The cross-root cert should work, but you need to make sure it's presented in the right order, I think.
FWIW, my latest RapidSSL-through-Namecheap certs were issued by:
issuer=/C=US/O=Equifax/OU=Equifax Secure Certificate Authority
And that's the "good"/trusted CA. I'm not sure when they made the switch, but I only got this cert issued a couple of months ago.
FWIW, we also support Docomo phones, and that is a huge pain in the ass. The only CA that works there is:
i:/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority
If you don't need to support really old mobile devices, the best certs going are, IMHO, Digicert. They get chained all the way back to Entrust:
1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV CA-1 i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA 2 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA i:/C=US/O=Entrust.net/OU=www.entrust.net/CPS incorp. by ref. (limits liab.)/OU=(c) 1999 Entrust.net Limited/CN=Entrust.net Secure Server Certification Authority
And the company has some of the best customer service going anywhere.
Re: Don't submit to the SSL cert racket. You can get one for no charge
#45Earlier quoted context omitted.
Be aware though that GeoTrust and Thawte certs don't work[1] on android devices. There are claims that it can be fixed by adding a cross-root cert[2] but for me that didn't work out. More generally: If you need to support mobile devices then read your CA's compatibility list closely (if you can find it...) and test, test, test. You'd think this shouldn't be an issue anymore in 2012, but it sadly still is. [1] http://…
Sigh. I spent way too much time picking these particular certs and they've gone and messed it up. :) The cross-root cert should work, but you need to make sure it's presented in the right order, I think. FWIW, my latest RapidSSL-through-Namecheap certs were issued by: issuer=/C=US/O=Equifax/OU=Equifax Secure Certificate Authority And that's the "good"/trusted CA. I'm not sure when they made the switch, but I only got…
If you don't need to support really old mobile devices, the best certs going are, IMHO, Digicert. They get chained all the way back to Entrust:
Not only that, they check your installed cert after you buy it and email you if you installed it incorrectly: http://www.digicert.com/help/
Re: Don't submit to the SSL cert racket. You can get one for no charge
#46Its worth to mention that their certificates cannot be used to secure a Java web service because their CA is not included in Java's cert bundle. I had to learn this when I tried to callout to a web service (with a startcom cert) from Salesforce. Also their certs are only free as long as you don't need to revoke it.
Came here to say something like this. While the site is a bit of a pain, and the certs are free, make damn sure you have your site configured the way you want it before you generate the certificate. It's $25 to revoke a cert, i.e. free up the name so you can use it again elsewhere. I used part of my domain name for an XMPP cert that I later wanted to use for a web subdomain with the same name.. nope. Stupid.
Why bother revoking? Get a new cert from someone else for 10$, ditch the old one, done.
Re: Don't submit to the SSL cert racket. You can get one for no charge
#47I've used StartSSL in the past. I will never do so again. Yes, the certs are free, and yes, they work in all common browsers. But the process of obtaining them is a horror of Lovecraftian proportions. I'll happily pay a few dollars to Namecheap to be able to avoid the nightmare that is StartSSL's UI.
We tried them but had to change to a different vendor because the Blackberries didn't recognize their certificates and they had no plans to rectify that. We don't have much BB traffic, but didn't want to exclude BB users just because we wanted to be cheap.
Re: Don't submit to the SSL cert racket. You can get one for no charge
#48My understanding is free ones are not trusted/accepted by the browsers, hence to have something that isnt tossing errors at your users requires a small payment to a CA. I've used positivessl from namecheap whenever I need certs, its something crazy cheap like $5
My understanding is free ones are not trusted/accepted by the browsers You might mean self-signed certificates?
Well anyone could start their own CA and hand out free certificates. The problem is that nobody trusts Joe Bloggs' new CA.
Re: Don't submit to the SSL cert racket. You can get one for no charge
#49I've used StartSSL in the past. I will never do so again. Yes, the certs are free, and yes, they work in all common browsers. But the process of obtaining them is a horror of Lovecraftian proportions. I'll happily pay a few dollars to Namecheap to be able to avoid the nightmare that is StartSSL's UI.
I disagree also. Their process is fine with me and very quick. I haven't had to contact them in a while, but when I did, got fast, intelligent response. StartCom/StartSSL is a breath of fresh air.
Re: Don't submit to the SSL cert racket. You can get one for no charge
#50Earlier quoted context omitted.
I'm actually shocked at how many places accept the trust chain of my free SSL certificate from Gandi. Some browsers refuse my company's very expensive wildcard certificate from GoDaddy saying it's not trusted but trust mine from Gandi!
Did you configure the server to send the intermediate certificates for your GoDaddy wildcard certificate? I've experienced similar problems in the past, but sending the intermediate certificate fixed it.
Yea, when you install any SSL certificate, don't forget the intermediate certs!