4 ms·

I've seen a lot of certificate issuers for $15/year, so I have a different question: Why the price difference? Are the cheap ones just as useful as the expensiv

by mcav 18y ago

I've seen a lot of certificate issuers for $15/year, so I have a different question: Why the price difference? Are the cheap ones just as useful as the expensive certs?

asmithmd1 18y ago
They all give you that little padlock icon in the users browser. When a user hovers over the padlock with mine they see "Verified by: GoDaddy.com" Is a purse from K-Mart as useful as one from Gucci? For holding stuff: yes. For impressing people how cool, important, reliable you are: maybe not. I only paid $15 for my "K-Mart" certificate which covers both <mydomain>.com and www.<mydomain>.com
mileszs 18y ago
Wildcard certs are more expensive because they cover any and all subdomains. (The perception is that they "do" more, so the price is hiked. I have not the expertise to know whether the issuer actually has to do more, or it's just a bit of a racket.) The other difference is High-Assurance certs, which involve someone from (for example) GoDaddy calling your business-use land-line phone (which is required) and verifying some information, if I recall correctly. Other than that, as far as I can tell, you're paying for the opportunity to put some silly seal on your site, bearing the name of whatever company of theoretically good repute, to make your users feel safe from the conniving, thieving, drooling hackers lurking behind each form button.
nickf 18y ago
Here we go: There's essentially 3 types of certificate: DV - Domain Validation. The cheap, automated ones. Certs contain no more than the domain name they're issued to, and the whole process is automated. OV - Organisational Validation. The original 'standard' of certs, that most CAs issued until a few years back. Domain ownership checked, business checked (for legal existence and verified address). EV - Extended Validation. The new 'green bar' standard. Lots of hoops to jump through - agreements, legally-notarised letters, checking of business existence with local govt. & third parties, phone number verification, verification that the person requesting the cert actually has the right to do so....and so on. The question then becomes: why? The OV and DV sadly appear the same to the user. A few years back, one CA decided to issue the certs purely based on domain checking. Automation = cheap certs = big, fast marker share. It took, they made money. Then a time came to do something about the DV certs (ie making the browser chrome showing them 'less' secure or similar). By this time, the big boys in the CA world had aquired the company and had a pretty penny invested in the DV certs not becoming the red-headed stepchild. So the CAs and the browser and the OS people invented EV. There's still talk that DV will be 'downgraded' one day, but we'll see. Other types: Wildcards as someone mentioned will cover unlimited subdomains of the domain they're issued to (traditionally certs are for single FQDNs). Then we've got the new UCC for MS Exchange/OCS which has multiple, unique FQDNs in a single cert. Then you've got client & email certs, code-signing, and more :)
- briansmith 18y ago
  "The OV and DV sadly appear the same to the user." AFAICT, OV and DV certs appear differently in the newest versions of every browser. Usually OV certs are blue and DV certs are white where EV certs are green.

by mcav 18y ago

I've seen a lot of certificate issuers for $15/year, so I have a different question: Why the price difference? Are the cheap ones just as useful as the expensive certs?

asmithmd1 18y ago

They all give you that little padlock icon in the users browser. When a user hovers over the padlock with mine they see "Verified by: GoDaddy.com" Is a purse from K-Mart as useful as one from Gucci? For holding stuff: yes. For impressing people how cool, important, reliable you are: maybe not. I only paid $15 for my "K-Mart" certificate which covers both <mydomain>.com and www.<mydomain>.com

mileszs 18y ago

Wildcard certs are more expensive because they cover any and all subdomains. (The perception is that they "do" more, so the price is hiked. I have not the expertise to know whether the issuer actually has to do more, or it's just a bit of a racket.) The other difference is High-Assurance certs, which involve someone from (for example) GoDaddy calling your business-use land-line phone (which is required) and verifying some information, if I recall correctly. Other than that, as far as I can tell, you're paying for the opportunity to put some silly seal on your site, bearing the name of whatever company of theoretically good repute, to make your users feel safe from the conniving, thieving, drooling hackers lurking behind each form button.

nickf 18y ago

Here we go: There's essentially 3 types of certificate: DV - Domain Validation. The cheap, automated ones. Certs contain no more than the domain name they're issued to, and the whole process is automated. OV - Organisational Validation. The original 'standard' of certs, that most CAs issued until a few years back. Domain ownership checked, business checked (for legal existence and verified address). EV - Extended Validation. The new 'green bar' standard. Lots of hoops to jump through - agreements, legally-notarised letters, checking of business existence with local govt. & third parties, phone number verification, verification that the person requesting the cert actually has the right to do so....and so on. The question then becomes: why? The OV and DV sadly appear the same to the user. A few years back, one CA decided to issue the certs purely based on domain checking. Automation = cheap certs = big, fast marker share. It took, they made money. Then a time came to do something about the DV certs (ie making the browser chrome showing them 'less' secure or similar). By this time, the big boys in the CA world had aquired the company and had a pretty penny invested in the DV certs not becoming the red-headed stepchild. So the CAs and the browser and the OS people invented EV. There's still talk that DV will be 'downgraded' one day, but we'll see. Other types: Wildcards as someone mentioned will cover unlimited subdomains of the domain they're issued to (traditionally certs are for single FQDNs). Then we've got the new UCC for MS Exchange/OCS which has multiple, unique FQDNs in a single cert. Then you've got client & email certs, code-signing, and more :)

briansmith 18y ago
"The OV and DV sadly appear the same to the user." AFAICT, OV and DV certs appear differently in the newest versions of every browser. Usually OV certs are blue and DV certs are white where EV certs are green.