I had a good experience with StartCom.
Ask HN: What's the best company to buy SSL certificates from?
61–70 of 71 posts
Re: Ask HN: What's the best company to buy SSL certificates from?
#62Earlier quoted context omitted.
Neither the linked article nor any of the parent comments talk about certificate chaining, which seems to be what you're referring to. Also, please check the definition of 'disingenuous', it's massively overused on Hacker News (often in a completely incorrect context).
jorangreef said "RE StartSSL..." then pointed to an article about the problems of SSL w.r.t mobile apps. Since this is in reply to a very positive post about StartSSL, the obvious inference is that his linked article provides some evidence on why one wouldn't want to use StartSSL. But that's pure FUD because the only mention of StartSSL in the whole article is that they close their connections so two more TCP connect…
OCSP isn't an optional step involved only if you don't present your CA's intermediary certificate, it's in addition to it. The whole point of it is "I have this guy with these legit looking credentials you issued, do you still stand by them?".
You can't work around that with chaining, it can only be disabled from client code, or by having the CA issue a cert that doesn't include an OCSP address (doubt any do this now, given the number of legit certs issued to attackers in the past 2 years).
Re: Ask HN: What's the best company to buy SSL certificates from?
#63I cannot recommend Comodo.
I paid for one of their certificates (through a re-seller) but they refused to issue it on the grounds that they could not verify my phone number. It was true that it was not in the directories they referred to, but they did not make that clear before selling the certificate.
I would have made a chargeback, but was paranoid about them informing other CAs of the fact - it would be a disaster if I was never able to get another SSL certificate.
Re: Ask HN: What's the best company to buy SSL certificates from?
#64I would definitely advice to you startssl.com, they offer free ssl certificates.
Re: Ask HN: What's the best company to buy SSL certificates from?
#65Don't feed the SSL cartel Free SSL cert accepted by all modern browsers https://www.startssl.com/?app=1 They are owned and operated by http://www.startcom.org/
startssl.com is part of the cartel you don't want to feed... Yes, they offer free certificates, but only in order to market their paid certificates.
FWIW, I use free certs from startssl.com myself.
If you really want to avoid the "cartel", use cacert.org or a self signed cert.
Re: Ask HN: What's the best company to buy SSL certificates from?
#66Earlier quoted context omitted.
What's the difference between a simple certificate and something higher-grade? What does the simple certificate lack that a higher grade certificate provides?
Extended verification certificates (EV; "actually verified") cause the browser bar to turn green. That will make people more likely to trust you.
The free one also wont work with wildcard certs, and will only accept one hostname in the subjectAltName field. My domain is "grepular.com", the certificate needs to contain "secure.grepular.com" for historical reasons. This means, when I use startssl, I can't include "www.grepular.com" in the cert. Unless I pay for a cert.
Re: Ask HN: What's the best company to buy SSL certificates from?
#67Earlier quoted context omitted.
Thanks for clarifying! Will a free StartSSL certificate trigger an 'untrusted source' warning from the browser? Also, will a free certificate be adequate for encrypting authentication data in a web API?
StartSSL is completely fine for those goals. Pretty much the only effect of an EV certificate is the green bar. (Which is easily worth $150/yr if you're doing millions in e-commerce, of course!)
By the way, I went ahead and got a free StartSSL certificate. So far it seems to work fine. Thanks again for your feedback.
Re: Ask HN: What's the best company to buy SSL certificates from?
#68Earlier quoted context omitted.
Verisign EV certs get the green text along with the name of the company in the browser (ex: https://paypal.com ) More information: http://www.verisign.com/ssl/ssl-information-center/extended-...
GoDaddy is listed among the issuers of EV certificates on Wikipedia, so don't they offer them? : http://en.wikipedia.org/wiki/Extended_Validation_Certificate (I don't know the difference between standard SSL certificates and EV ones)
GoDaddy does look like they offer them:
Re: Ask HN: What's the best company to buy SSL certificates from?
#69A little off topic, but I'm thinking of using CloudFlare's "Easiest SSL Ever"... Is anyone here using it? http://blog.cloudflare.com/easiest-ssl-ever-now-included-aut...
Not yet, but that's my plan :) I'll setup CloudFlare soon, for the "go live" of my new startup this month.
Re: Ask HN: What's the best company to buy SSL certificates from?
#70Don't feed the SSL cartel Free SSL cert accepted by all modern browsers https://www.startssl.com/?app=1 They are owned and operated by http://www.startcom.org/
startssl.com is part of the cartel you don't want to feed... Yes, they offer free certificates, but only in order to market their paid certificates. FWIW, I use free certs from startssl.com myself. If you really want to avoid the "cartel", use cacert.org or a self signed cert.
I will use cacert as soon as they're part of the standard cert group on all the major browsers :P