4 ms·
If the SSL/TLS server is properly configured with all of the nodes in the certificate chain, you don't need to buy more expensive certs. Now I will say that, m
by spydum 14y ago
If the SSL/TLS server is properly configured with all of the nodes in the certificate chain, you don't need to buy more expensive certs.
Now I will say that, most common apps (Apache HTTPD + mod_ssl for example), do not make this process as clear as it should be. Specifying cert order wrong in the Intermediate Chain file will still break cert validation for some apps, because it's sent out exactly as the server admin configures (and this fact is often lost of folks who maybe touch their certs once a year when they expire).
- Firehed 14y agoThere's no standard as to which certificate issuers have their trusted root CA cert installed. If your clients don't have it on their machines (desktops, phones, servers, whatever) it doesn't matter what you paid. My point was that the more widely-trusted issuers (meaning installed by default on the most OSes) can get away with charging more because they're more compatible. There's nothing stopping you from setting up your own root CA and self-signing, maintaining a full chain of trust if you build the certs right (I've done it; once you have the process documented well it only takes a few minutes) but unless the clients trust the lowest link in the chain (not the case for self-signed, and some cheaper issuers) you'll still get validation errors.