Hacker News Reader

Comment by jacquesm | Hacker News Reader

Before you jump at this, research the reputation of your SSL certificate provider.

https://www.google.com/search?q=comodo+reputation

$50 is a pretty good price, the nearest competitor is charging about double that. Still, if you are going for a wildcard SSL certificate (and you already need one even if you just want to respond to www.example.com and example.com using https) then likely the $50 is a rounding error on your annual expenses. It's good to be frugal, and if you feel that comodo is good enough for you then this is as cheap as it gets.

View on HN

See mjpa: For most cases this should be covered by SubjectAltNames [1].

That means for simple cases you might even get away with free StartSSL certificates (ignoring the limitation to one year). If you ask for one for 'www.example.com' you'll get one with SubjectAltName example.com. Maybe (not sure) some $#^@# clients don't support that, though?

For personal stuff I'd still stick to this solution instead of shelling out $50.

1: http://stackoverflow.com/questions/5935369/ssl-how-do-common...

You don't need a wildcard for domain.com + www.domain.com. I've got several cheap (~$7) certificates that have both listed

The StartSSL free ones do this too, I have them on all my domains.

actually you can get alphassl for $40-50 as well. Comodo is pretty good for the price range. You can pay a bit more for a GeoTrust or an arm and a leg for Thawte or VeriSign, but there is no difference between all these SSL. It's purely marketing BS.

> It's purely marketing BS.

It's worse than that. SSL certificates are simply just another racket, and they're a lot more expensive than domain names.

There is no added value from having a certificate from some authority or other beyond the knowledge that your bits are encrypted, the checks performed (even for the high end ones) are perfunctory and users put far more trust into little lock icons or green bars than is warranted.

That said, if your cert provider is hacked it can be a real pain.

I agree, although having one from a trusted authority is better than not having one. And customers come to expect that you have SSLs installed. Never mind if the data at rest is actually encrypted..

Their site has them at $149 (single domain certs are $49). StartSSL offers the wildcard ones at $59. Like Comodo, not everyone trusts them (however, browsers do). Would be delighted to learn of a cheaper wildcard cert.

Yes, even RSA had it's share of breaches. From a customer perspective, it'll show the lock even on mobile devices, which I've found others to be lacking in (looking at you, RapidSSL)

Had similar problems with RapidSSL (not the wildcards, the regular ones) and it turned out you have to include a cross root CA that chains to a Geotrust intermediate CA (my terminology may not be quite right, but it certainly worked for me). Its been a while since I did it but there's a pointer on how to get it done here: http://support.servertastic.com/rapidssl-and-geotrust-certif...

Reply on news.ycombinator.com