Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My boss wants to buy a certificate for his SBS so external connection can be made. they access on an IP number. What should he spend on the certificate? Where should he buy from?

Verisign seems like overkill as its not an ecommerce site, just needs some security. Ive seen some cheap ones at $20 / yr - are there any problems with getting cheap certificates?

share|improve this question

6 Answers 6

up vote 2 down vote accepted

I recommend GoDaddy for buying the certificates, good price.

As for linking to an ip address, I would not recommend that even if it's possible. You want to link the certificate to your domain name, and point the domain or sub domain at your ip address in DNS. This way if you change ISP's, you just update the new IP in the DNS and back in business, no need to adjust the Certificate.

Also for SBS make sure to watch closely which certificate. I believe the multiple domain ones are recommended for SBS so that Exchange, Webmail, and Exchange over HTTP will all work.

share|improve this answer
    
Thanks Brian, that helped –  bergin Jun 4 '10 at 13:11

StartCom provides free SSL certificates. The StartCom Certification Authority is supported by the most common web browsers.

share|improve this answer
    
StartCom has been included in the Root Certificates Update for Internet Explorer since September 2009 (see Eddy Nigg's blog post "The 'e' of the Internet" dated August 19, 2009: blog.startcom.org/?p=205). –  jnaab Jun 3 '10 at 17:30
    
i just looked in my IE8 cert store and i am not seeing it. also , the FAQ at StartCom suggests that with Firefox that you need to manually install the cert into the browser keystore. –  djangofan Jun 4 '10 at 18:12

What does using a certificate have to do with "making external connections"?

Can you be more specific in what he wishes to do?

share|improve this answer
    
Sounds like he wants to use something like Outlook Web Access. I suspect that it works with a self signed certificate, but it looks rather unprofessional to have users be warned that the certificate is self-signed. –  Tom O'Connor May 31 '10 at 12:48
    
That was my thought but see no reason it would be considered unprofessional for internal users. –  keith stokes May 31 '10 at 12:59
    
I noticed that common users have no clue what a any of these words stand for "self-signed ssl certificate". They will maybe ask what to do if such a warning pops up. –  SamK May 31 '10 at 13:10
    
Tell them "Click Accept the first time you check your e-mail." Educating users how to behave is part of the job. Bergin or his boss will have to teach them how to access it anyway; this adds 1 step 1 time. –  keith stokes May 31 '10 at 13:20
3  
If i had $10 for every user who asked me why they had to accept a warning, I'm sure I'd have enough for a SSL Certificate to save me having to answer those questions ever again. –  Tom O'Connor May 31 '10 at 14:26

They shouldn't access on an IP address as you say, most Certificate Authorities won't certify that.

share|improve this answer
    
+1 and accessing via IP address is also asking for trouble when you have to change your IP address later on. I know you're thinking you won't ever have to change the ip address, but you will. –  kaerast Jun 1 '10 at 13:56

I use and recommend GoDaddy (who actually resells Starfield Tech certs). The certs are $30/yr for a single computer, standard verification (blue bar on most browsers).

If you need something more complicated the prices goes up as they support more features. But the standard will work just fine; and is recognized by all modern browsers.

share|improve this answer

You could try QuoVadis. They are generally a lot cheaper than people like Verisign. http://www.quovadisglobal.com/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.