-3

Our requirements are simply to secure end-to-end communication over https://. We need it from a CA that will be available on most android / iphones.

The variety of certificates out there are simply mind boggling and range from free to 1000USD.

Advice ?

1
  • There are so many possible relevant factors, you don't talk about. Insurance, domains (subdomains, wildcard), can you ship the CA in the app (then you can set up your own). Also, you ask for product recommendations, which are off-topic here on Server Fault.
    – sebix
    May 14, 2015 at 10:23

1 Answer 1

1

First, you can omit any that mention Extended Validation (EV) certificates, as the additional functionality they provide are only useful for browsers, and tend to have shorter lifetime.

Second, there is nothing inherently special about it being an API... other than as noted above. It's your choice if you want to use client-certificate authentication, but I doubt that would would.

Third, you say that you are only (?) considering mobile applications. In this case, you can ship a CA certificate (even one that you provide at no cost to yourself) and that will be the trust-store that you configure your application to use. Then your server just has to present a certificate that is signed by your CA. This is known as certificate pinning, and mobile applications are a good example of it, because you (the application vendor) supply the trust store to use when connecting to your (API-vendor) service.

Otherwise, just pick anything SHA-2 that is known to Firefox. Ensure that your service offers the intermediate certificates in the handshake (important when working with smaller CA's).

0

Not the answer you're looking for? Browse other questions tagged .