There is no real bad or insecure option. Just make sure the CA is supported by all the platforms / browser you need and that the price is fair. Additionally you

There is no real bad or insecure option. Just make sure the CA is supported by all the platforms / browser you need and that the price is fair. Additionally you may check that their revocation servers have a good internet connection since browsers check these. It is even totally unimportant if your provider is "insecure". If any of the commonly trusted CAs is hacked it affects the security of your service as well as if it's the CA you use. Therefore I would go with StartSSL (https://www.startssl.com/ https://www.startssl.com/). They are trusted on all important plattforms, are free for one subdomain per domain and very cheap otherwise. You only pay the verification of your identity, unlimited domains, wildcard etc. then. I haven't seen any cheaper one. You might get some competitive prices if you combine the use of single subdomain ones through SNI, but I wouldn't prefer that over a inexpensive wildcard one. What is the worst that can happen? If the revocation servers go down, the browser just shows a small warning symbol, but everything still works. If your CA gets hacked and untrusted in common browser, you have to buy a cert somewhere else ... this is the risk of every CA and a new cert is just minutes away ... There is no way to determine who is more secure against hacks etc. If they are trusted where you need them, they are all equal.