HN Explorer

Ask HN: where do you get your SSL certificates?

77 points by yarek ↗ HN
I got a certificate from GoDaddy, and it only seems to work without throwing user warnings on only a handful of browsers (FF on windows, but not on Linux, not chrome, etc). Shelling out several hundred bucks for a Verisign certificate seems awfully steep for a shoe string operation. Are there better alternatives?

53 comments

[ 0.86 ms ] story [ 128 ms ] thread
Judson
We use a Comodo certificate, but it's been so long since we got it issued, I don't think they even offer it anymore?!?

I would try these sites:

- http://instantssl.com (comodo)

- http://www.sslmatic.com (retailer of various)

That should be a start.

andymoe
Check out this thread: http://news.ycombinator.com/item?id=464916

Also, you might want to provide a bit more about the cert you currently have if you want to know why it's not working on other browsers. Finally, you might want to consider asking/browsing on serverfault.com. There are good discussions on the topic of SSL on that site.

stretchwithme
maybe something's wrong with how you configured it. Maybe the host name doesn't match?
pyre
Why would that change between browsers and operating systems?
yarek
Because different browsers have different set of root certificates/authorities to authenticate the certificate.
pyre
Ah. The host name on the root cert. I was thinking that the host name on the server's certificate was being referenced.
resdirector
No, it's godaddy...I have the same problem. Not entirely sure why browsers don't trust godaddy. Perhaps because godaddy is cheap and dirty.
tienshiao
I just picked up a cert from GoDaddy a couple weeks ago. I don't have any issues with FireFox, Chrome, Safari on OSX, and no problems with IE8 on XP.

Guess I'll have to check the other combinations later.

I would double check the configuration. Maybe something is up with the intermediate certificate?

mkramlich
my next HTTPS cert will be from DynaDot since I liked how they run their DNS registrar service (with optional API, yeah!) and generally got a "smart" vibe from them. I've gotten certs from VeriSign and generally found it surprisingly expensive, complex and slow. Fundamentally, a file needs to be generated. Generating that file should be pretty fast on a modern computer, and a commodity service. Yes there's some extra stuff potentially involved. But at it's core it should be a pretty simple and fast and therefore cheap process. IMO.
bensummers
http://www.trustico.co.uk/products/rapidssl/cheap-rapidssl-s...

Cheap, no certificate chain, and everything seems to have the roots installed.

It doesn't really matter where you get them from, the whole thing is a bit of a scam anyway. Since your security is as weak as the worst issuer, there's no point in buying a "premium" certificate.

weaksauce
I agree it's a scam but are they recognized in mobile phones? I cannot find a cheap one that is good for my android phones at work.
petercooper
Since your security is as weak as the worst issuer, there's no point in buying a "premium" certificate.

True for most of us here, but not universally true. Extended validation certificates are expensive but provide an unparalleled level of reassurance for users: http://en.wikipedia.org/wiki/Extended_Validation_Certificate

bnoordhuis
I respectfully disagree. I recently bought an EV certificate from VeriSign and, apart from some paperwork, the only "extended" validation was a two minute phone call from a VeriSign rep. Well worth the EUR 575,- :/
petercooper
What I mean is the "green bar" or "green text" in the Web browser. I'm no SSL expert (though not a novice either) but I do like seeing that appear when logging into online banking or PayPal. If it didn't come up that way, I'd be immediately suspicious.
sirclueless
I assume they verified that you are in fact a citizen of a first-world country, possibly with an actual company that pays its taxes. That's basically all the trust an average site needs. It's not so much that your website can now be trusted to never do anything nasty, but if it ever does there is someone to hold accountable.
carl_
There will of been at minimum checking for address and phone listings for the company (yell or scoot for UK EV's) in addition to the human telephone validation for signer and approver.
carl_
Different applications for EV certs will be required to provide certain additional information and all validations must pass CAB guidelines.

We personally use Comodo for our 'cheap' certificates as we get massive buy discounts and GlobalSign for EV as they've have a 2048 bit default root since the start.

bensummers
You are assuming that the users will notice the lack of green text for the EV certificate in their browser. It is not an error to use a non-EV certificate, even if the site 'should' have one.

(defining 'should' here is difficult)

dflock
Yeah, I would disagree with this as well - they're supposed to provide more reassurance, but all the studies of user awareness of this - and security UI in general - generally conclude that almost nobody has a clue what these mean or even noticed their existence:

- http://www.securityfocus.com/print/columnists/405 - read the linked PDF, if you haven't already - it's pretty eye-opening. - http://i.imgur.com/u7PFH.jpg - this turned up on reddit the other day.

sapphirecat
EV only really got in the news after Comodo resellers were caught issuing 'validated' certificates with no actual validation whatsoever. (Conveniently, there was a fresh release of IE that displayed EV certs in green.) Any validation process is as weak as the worst issuer, 'extended' or otherwise, and promising to do better validation for more profit doesn't really serve to deter the actual violation that got us here to begin with.
teoruiz
This can be read in the process of issuing a wildcard certificate a Trustico: https://www.trustico.co.uk/geodirect/order/step1.php

The server count option tells us how many physical servers you intend to install RapidSSL Wildcard on. A licence will be activated for each physical server installation and you must pay the full product price for each additional server installation. Most customers choose to install RapidSSL Wildcard on 1 physical server only. RapidSSL Wildcard includes 1 server licence free of charge and can be installed an unlimited number of times on each licenced physical server.

Licenced SSL certificates per server? Come on.

sern
StartCom - their "domain validated" certificates (which other CAs charge for) are free: http://www.startssl.com/
zmmmmm
StartCom is great, but 2 caveats: I found that StartCom's root authority is not recognized by some IE6 installs, and is still not recognized by Java (so applets, web start, java clients talking to your server may have problems ...).
ROFISH
The first time a user goes to StartCom on Windows XP on IE6, it will pop up with a "cert error". This is because the user hasn't recently updated their root certs through a super-optional Windows Update install. However, any subsequent loads will work as Windows will check and update their root certificates in the background.
micheljansen
Even better, they don't charge for "products" such as wildcard certificates, but for the service of validation that is required to get them. This means you pay once for the validation (much less than a single wildcard certificate costs elsewhere) and then you can create certificates for all your domains at no additional cost.

Obviously, they are a small CA, which means they are not recognised on some exotic platforms, but I haven't ran into any of those cases myself. Also, they require an intermediate certificate, but that was a no-brainer to setup. I have one up on my personal website, if you want to try if it works for you: https://micheljansen.org

techsupporter
Edit: OK, they seem to work pretty well. This is a nifty idea.
bwlang
my only problem with them is the somewhat complicated mechanism for authentication with client certs. I could not get it to work with firefox or chrome, just safari.
malbs
startssl.com is who I use. I haven't had any issues, then again I'm not particularly worried about exotic platforms, or IE6 support.
resdirector
(Disclaimer: I don't know what I'm talking about) You might want to try DigiCert: I researched a few different providers earlier this year, and DigiCert seemed to be cheap and trusted. No direct experience with them, tho.
d_r
This is a known issue with GoDaddy certificates, and can be corrected by specifying an intermediate cert. I ran into the same issue at one point in the past and had to Google a bit to fix it.

GoDaddy itself is not a trusted CA on all platforms. It is backed by a trusted CA. To make this work, you have to add a "certificate chain" in your web server and provide the additional certificate linking GoDaddy to that trusted CA.

Read more about the configuration here. Note that you'll have to download one additional certificate, not just the main signed certificate. http://help.godaddy.com/article/5346

Here is what my ssl.conf looks like in Apache:

   SSLCertificateFile /etc/httpd/foo.crt
   SSLCertificateKeyFile /etc/httpd/foo.key
   SSLCertificateChainFile /etc/httpd/gd_bundle.crt
That gd_bundle.crt is what you're probably missing. Hope this helps.
yarek
Thanks for the info - sounds reasonable. Now I have to figure out how to make that work for hunchentoot.
svnv
We use thawte.
ScottWhigham
I've tried using thawte - I placed 3 sales calls and an email. No one ever answered the phone (an 800 number!) and it took three weeks for someone to call me back after the email. No thanks
superk
Seconded - their support and checkout process all suck hard. What's great about SSL's... they are all scams.. but you get to decide the level for which they screw you.
pstevensza
Yup. Their interface doesn't even support the ability to add licenses to an existing certificate since their software update. Thanks but no thanks, I can save my company a bomb by going elsewhere
ytNumbers
I've been a customer of theirs for most of the last ten years. They used to be quite good. However, my recent experiences with them have convinced me that I will need to find a new provider when my certificates expire. With Thawte, you'll pay a premium price and receive poor customer service.
evandavid
I was thinking about this just today. I want a cert to use with Heroku. I love Dreamhost and I use them for all my static websites, backup storage, git hosting, and domain registration. They provide SSl certs for $15, but I've never bought one and they don't provide a lot of details. They mention that you can use them with other hosts, but not much else.

Anyone have experience with Dreamhost SSL?

smiler
I've used them and they work fine. They say they don't provide IIS support (indeed, the format of their certs doesn't work for IIS, but you can use an online convertor to get them into the right format).

I believe they just resell comodo from when I used it last, but you could probably check

noibl
I use NameCheap's RapidSSL product for $10/yr. The only thing I don't like about it is that when you register, the 'Organization' value you enter gets overwritten with the common name/domain name. This means that when someone reads the certificate details in their browser, they can't find any reference to your actual company name.
jread
+1 NameCheap - $10/yr, automated ordering & no chain file
david_p
I use gandi.net. Gandi provides a free SSL certificate (for one year) when you buy/renew a domain from them. It's quite a good deal.

http://en.gandi.net/ssl

uptown
Are SSL certificates internationally recognized? In other words, if I have users coming from both the US as well as a variety of other nations, will SSL certificates be recognized regardless of the user's origin, or is there such a thing as an international SSL certificate?
carl_
Yes, though check with your CA for IDN support.
nopal
I like DigiCert.

One nice thing they do is give you a www alt name for your domain. (e.g. alt name == www.apple.com for domain apple.com). Thawte charges a minimum of $169 for this.

This means that your certificate will be able to be used by www.domain.com and domain.com.

Some certs aren't able to be used for both (https://amazon.com), and the alternative is to buy two certs.

JangoSteve
I bought RateMyStudentRental's SSL cert from Godaddy and it was a PITA to setup compared to if you get a trusted root certificate (that does not need to be chained).

After reading this thread [1] I bought LeadNuke's SSL cert from NameCheap (a rebranded RapidSSL certificate). Sure enough it was incredibly easy to setup, and is trusted on all the main browsers.

[1] http://news.ycombinator.com/item?id=1318340

oomkiller
You probably forgot to combine the intermediate certs with your domain cert. That said, I use startcom (http://www.startssl.com/). You can get free SSL certs there that work in 99% of browsers. If you pay the identity verification fee (I think about $50), you can get free WILDCARD certificates!
bhiggins
I got a free 3 month certificate from Comodo and then I used a promotional offer from RapidSSL for Comodo customers to get a free 1 year cert (in addition to 3 months). Result: free 15 month certificate.
yarek
Note: Used RapidSSL, paid $10.95. Best lunch's worth of money ever spent. Beats GoDaddy, as no cert chains are not required.