About https. I am ashamed that I've not yet purchased a recognized certificate. There should be a self signed certificate running, but since I did not set up my own CA, this is not really ready for production. The example code in the documentation does not verify the ssl endpoint. I need to fix that..
How do others handle this?
I wanted to buy a signature from a CA that is recognized by the majority of browsers and build my own CA for the API.
If something goes wrong then StartSSL revocation is not free but as the revocation system is pretty broken anyways u might not care, see [1] for details, if interested.
I'd use a recognized CA also for the API (smth recognized by all supported language SDKs). It can be a trouble to guide users through adding your CA as trusted CA for each case. Python, Java etc look up certs with a different strategy/have different CA truststores. For me namecheap has been one of the best offers for cheap SSL certs when StartSSL becomes too inflexible [2] or is not supported widely enough [3].
[1] http://www.ahtik.com/blog/startssl-revocation-fees-will-not-...
[2] Each free StartSSL domain can have exactly one alternate domain name, so you can have one cert with both template2pdf.com and www.template2pdf.com OR template2pdf.com and api.template2pdf.com OR www.template2pdf.com and api.template2pdf.com.
[3] AFAIK at least java 6 & 7 does NOT ship with StartSSL CA included in truststore.
EDIT: The marketing speech that is often used to claim that more expensive certs are for more serious business is mostly baseless. Yes, you can pay to have your identity checked more carefully and pay even more to get the extended validation and a green bar, but this is "eye-candy" for most cases.
Nothing at https://www.startssl.com/?app=1 tells that free Class 1 cert is not allowed for commercial purposes.
quote: Class 1 certificates are limited to client and server certificates, whereas the later is restricted in its usage for non-commercial purpose only. Subscribers MUST upgrade to Class 2 or higher level for any domain and site of commercial nature, when using high-profile brands and names or if involved in obtaining or relaying sensitive information such as health records, financial details, personal information etc.