Comment by flavmartins | Hacker News Reader

Comment by flavmartins | Hacker News Reader

DigiCert.com is the CA that will give you the trust and assurance with the high verification standards that you would get with the Verisigns (Symantec) of the world but with the start-up like cool customer service and affordable price that customers today deserve.

The cheapest SSL options there ($20 and under) offer NO verification of the applicant of the certificate. Thus, you could be a scammer for all they care, as long as you control your site (even a phishing site) they've give you the "domain validated" certificate.

Stick with either EV (green bar, extra assurance) or a high-assurance only shop like DigiCert, Symantec, Entrust, or GlobalSign. It'll also show your users you care about trust and identity assurance online.

> The cheapest SSL options there ($20 and under) offer NO verification of the applicant of the certificate.

Your logic is wrong here. It is totally unimportant which CA you use, as long as any commonly trusted CA just checks the domain ownership using a mail address. A man-in-the-middle could simply replace your cert with that one and the user gets no warning.

> Stick with either EV Green/blue bars are a remarkable feature the user sees and might give trust. Those one are already available for $200 for 2 years. But I'm not sure if a user would realize that a MITM attack has removed the color. He wouldn't get a warning as long as any valid cert is still used. See my response above.

> or a high-assurance only If you need assurance, then yes. But a normal user doesn't care of that. And you should then also check the exact terms and conditions as well as other assurance services.

> The cheapest SSL options there ($20 and under) offer NO verification of the applicant of the certificate

Could you explain why that matters for the site owner?

It doesn't matter in any way. Especially it has no influence on security. A cert that works works. You might be interested in additional features like EV for the green/blue address bar or a assurance. But that's not the point.

Reply on news.ycombinator.com