5 ms·

I have dozens of unique domain names to secure and growing. The cost of buying an individual cert for each one is prohibitive. What can be done instead?

by lsh 13y ago

klapinat0r 13y ago
If they have to be SLD then there's not really anything you can do as to avoid the number of individual certs. In terms of cost two obvious choices arise: * Maybe look into becoming a cert reseller? * Make your own CA. You could then bundle, but you'd still need the individual certs either way.
finnn 13y ago
There are some CAs don't charge for certs, so unless you want an EV cert or something silly, them?
lsb 13y ago
No it's not, it's literally $0. https://startssl.com/?app=1 https://startssl.com/?app=1
- liotier 13y ago
  Except for anything that might actually involve liability. Put "shop" in the domain for which you want a free certificate and you will have it rejected by Startssl.com
  - lsh 13y ago
    that was helpful making a decision, thankyou.
- dangrossman 13y ago
  Their free cert is for non-commercial use only per their terms of service / certificate policy.
- duncanawoods 13y ago
  I recently tried the free startssl cert. Fine on IOS/OSX/W7 Chrome/Safari/Firefox/IE but it was rejected by Android default browser where startssl must not be a known CA. I don't think I can do without Android.
  - hnha 13y ago
    I have no issues with their certs on android 2.3.
  - sampk 13y ago
    Either you misconfigured it or you tested using Android <2.1[1] which accounts for less than 1% Android users. https://code.google.com/p/android/issues/detail?id=21632 https://code.google.com/p/android/issues/detail?id=21632
    - duncanawoods 13y ago
      Thanks for the link, it helped me get there. I followed the documentation and tutorials for nodejs/express which defined the cert and key. As your link suggested, mobile browsers are less lenient about missing intermediate ca information so adding this solved it: var express = require('express'), path = require('path'), http = require('http'), https = require('https'), fs = require ('fs'); var app = express(); var options = { key: fs.readFileSync('cert/rsa.key'), cert: fs.readFileSync('cert/rsa.crt'), ca: fs.readFileSync('cert/sub.class1.server.ca.pem') // needed this }; https.createServer(options, app).listen(443);
madsushi 13y ago
StartSSL will let you do a multi-domain wildcard cert for $75 for 2-years (with identity verification). You toss all of your root domains on a single cert as wildcards, and use it everywhere. Cert lasts for 2 years and can be updated at any time to add new wildcard domains to it. You could in theory get 4 years out of it by adding a domain on the last day if your identity verification 2-year cycle, which refreshes the 2 years on the cert. I use this method and it is awesome. One big multi-domain wildcard cert for everything.
- lsh 13y ago
  > StartSSL will let you do a multi-domain wildcard cert for $75 for 2-years (with identity verification) I think that is this product: https://startssl.com/?app=2 https://startssl.com/?app=2 A comparison of their features is here: https://startssl.com/?app=40 https://startssl.com/?app=40 "multi-domain" is what I'm after, right? I manage many domain names all pointing to a single IP.
  - elchief 13y ago
    I believe you need to buy the identity cert first ($60/year) and then the org cert ($60/year), so more like $120 a year if you want the org cert, but still a good deal.
    - lsh 13y ago
      StartSSL seem technically competent, but at the $100+ per year they no longer become the cheapest and I don't have to put up with their dodgy-as-hell website. Comodo via Namecheap seem to have better pricing and less weirdness: https://www.namecheap.com/ssl-certificates/comodo/multi-domain-ssl.aspx https://www.namecheap.com/ssl-certificates/comodo/multi-doma... Edit: I take that back. The above link is deceptive and the price charged is for the default number of domains that come with the package. Any additional domains cost extra. This is such a headache already. Lets not devolve this thread into price comparisons and end it here.
      - elchief 13y ago
mnordhoff 13y ago
You can afford dozens of $10 domain names, but dozens of $10 SSL certs would break the bank?
- lsh 13y ago
  We host the service for our clients. Our clients choose and pay for their own domain name. The majority of our clients are not-for-profit. It certainly wouldn't break the bank but it is an additional cost to doing business. The question was a little sly - I was fishing for the solutions my peers used by posing a beginners question. I hadn't heard of StartSSL before so it has been a success.

I have dozens of unique domain names to secure and growing. The cost of buying an individual cert for each one is prohibitive. What can be done instead?

by lsh 13y ago

I have dozens of unique domain names to secure and growing. The cost of buying an individual cert for each one is prohibitive. What can be done instead?

klapinat0r 13y ago

If they have to be SLD then there's not really anything you can do as to avoid the number of individual certs. In terms of cost two obvious choices arise: * Maybe look into becoming a cert reseller? * Make your own CA. You could then bundle, but you'd still need the individual certs either way.

finnn 13y ago

There are some CAs don't charge for certs, so unless you want an EV cert or something silly, them?

lsb 13y ago

No it's not, it's literally $0. https://startssl.com/?app=1 https://startssl.com/?app=1

liotier 13y ago
Except for anything that might actually involve liability. Put "shop" in the domain for which you want a free certificate and you will have it rejected by Startssl.com
- lsh 13y ago
  that was helpful making a decision, thankyou.
dangrossman 13y ago
Their free cert is for non-commercial use only per their terms of service / certificate policy.
duncanawoods 13y ago
I recently tried the free startssl cert. Fine on IOS/OSX/W7 Chrome/Safari/Firefox/IE but it was rejected by Android default browser where startssl must not be a known CA. I don't think I can do without Android.
- hnha 13y ago
  I have no issues with their certs on android 2.3.
- sampk 13y ago
  Either you misconfigured it or you tested using Android <2.1[1] which accounts for less than 1% Android users. https://code.google.com/p/android/issues/detail?id=21632 https://code.google.com/p/android/issues/detail?id=21632
  - duncanawoods 13y ago
    Thanks for the link, it helped me get there. I followed the documentation and tutorials for nodejs/express which defined the cert and key. As your link suggested, mobile browsers are less lenient about missing intermediate ca information so adding this solved it: var express = require('express'), path = require('path'), http = require('http'), https = require('https'), fs = require ('fs'); var app = express(); var options = { key: fs.readFileSync('cert/rsa.key'), cert: fs.readFileSync('cert/rsa.crt'), ca: fs.readFileSync('cert/sub.class1.server.ca.pem') // needed this }; https.createServer(options, app).listen(443);

madsushi 13y ago

StartSSL will let you do a multi-domain wildcard cert for $75 for 2-years (with identity verification). You toss all of your root domains on a single cert as wildcards, and use it everywhere. Cert lasts for 2 years and can be updated at any time to add new wildcard domains to it. You could in theory get 4 years out of it by adding a domain on the last day if your identity verification 2-year cycle, which refreshes the 2 years on the cert. I use this method and it is awesome. One big multi-domain wildcard cert for everything.

lsh 13y ago
> StartSSL will let you do a multi-domain wildcard cert for $75 for 2-years (with identity verification) I think that is this product: https://startssl.com/?app=2 https://startssl.com/?app=2 A comparison of their features is here: https://startssl.com/?app=40 https://startssl.com/?app=40 "multi-domain" is what I'm after, right? I manage many domain names all pointing to a single IP.
- elchief 13y ago
  I believe you need to buy the identity cert first ($60/year) and then the org cert ($60/year), so more like $120 a year if you want the org cert, but still a good deal.
  - lsh 13y ago
    StartSSL seem technically competent, but at the $100+ per year they no longer become the cheapest and I don't have to put up with their dodgy-as-hell website. Comodo via Namecheap seem to have better pricing and less weirdness: https://www.namecheap.com/ssl-certificates/comodo/multi-domain-ssl.aspx https://www.namecheap.com/ssl-certificates/comodo/multi-doma... Edit: I take that back. The above link is deceptive and the price charged is for the default number of domains that come with the package. Any additional domains cost extra. This is such a headache already. Lets not devolve this thread into price comparisons and end it here.
    - elchief 13y ago

mnordhoff 13y ago

You can afford dozens of $10 domain names, but dozens of $10 SSL certs would break the bank?

lsh 13y ago
We host the service for our clients. Our clients choose and pay for their own domain name. The majority of our clients are not-for-profit. It certainly wouldn't break the bank but it is an additional cost to doing business. The question was a little sly - I was fishing for the solutions my peers used by posing a beginners question. I hadn't heard of StartSSL before so it has been a success.