Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, marketing claims, and price range. I created a list to help me see passed the marketing gimmicks that the greater majority of the Certificate Authorities (CAs) plaster all over their sites. In the end my personal conclusion is that pretty much the only things that matter are the price and the pleasantness of the CA's website.

Question: Besides price and a nice website, is there anything worthy of my consideration in deciding where to purchase a wildcard SSL certificate?

share|improve this question
5  
I recognize the point that "questions seeking product recommendations are off-topic because they tend to become obsolete quickly", but my question is not of the style "Macbook Air vs. Macbook Pro". I believe this is a legitimate professional system and network administrators' question, particularly given the reality of overwhelming and super confusing options out there (at least for SSL first timers). I believe folks will find my research helpful. –  user664833 May 30 at 22:50
2  
Furthermore, in my question I specifically asked what one should consider when looking for wildcard SSL certificates - that is not going to become obsolete any time soon (and the beauty of Server Exchange Q&A is that answers can be updated). I trust a peer-reviewed answer from Server Fault much, much more than any single site that I have come across during my research (which was very time consuming by the way) - as most of those sites are marketing/SEO gimmicks. –  user664833 May 30 at 23:06
2  
@tom-oconnor This is not a request for a product, service, or learning material recommendation. This is a request for points for consideration with respect to obtaining wildcard SSL certificates. Can you be more specific with your objection? (Can you point out any reference to a request for product, service, or learning material recommendation in my question?) –  user664833 Aug 27 at 15:53
1  
One criteria that should not drive your decision is security of the CA. And it is important to understand why. The reason is that any CA you are not doing business with could compromise your security just as easily as one that you are doing business with. There are two ways poor security of a CA could harm you. If they get your credit card number, they could leak it (this is not different from any other online transaction). And if they do something so bad that browsers stop trusting them, you need to get a new certificate from a different CA on short notice. –  kasperd Sep 2 at 11:21

3 Answers 3

At the time of this writing I believe that with respect to deciding where to purchase a wildcard SSL certificate, the only factors that matter are the first year's cost of an SSL certificate, and the pleasantness of the seller's website (i.e. user experience) for the purchase and setup of the certificate.

I am aware of the following:

  • Claims about warranties (e.g. $10K, $1.25M) are marketing gimmicks - these warranties protect the users of a given website against the possibility that the CA issues a certificate to a fraudster (e.g. phishing site) and the user loses money as a result (but, ask yourself: is someone spending/losing $10K or more on your fraudulent site? oh wait, you are not a fraudster? no point.)

  • It is necessary to generate a 2048-bit CSR (Certificate signing request) private key to activate your SSL certificate. According to modern security standards using CSR codes with private key size less than 2048 bits is not allowed.

  • Claims of 99+%, 99.3%, or 99.9% browser/device compatibility.

  • Claims of fast issuance and easy install.

  • It is nice to have a money-back satisfaction guarantee (15 and 30 days are common).

The following list of wildcard SSL certificate prices and issuing authorities and resellers was created on May 27, 2014:

 price |  
/ year | Certificate Authority (CA) or Reseller 
($USD) |  
-------+--------------------------------------- 
   $94 | Namecheap / Comodo (PositiveSSL) * 
  $100 | DNSimple / Comodo (EssentialSSL) * 
       |                                    
  $100 | sslpoint / Comodo (PositiveSSL) *  
  $150 | AlphaSSL / GlobalSign            
  $200 | RapidSSL                         
  $450 | Comodo                           
       |                                  
  $500 | Thawte                           
  $500 | GeoTrust                         
  $600 | DigiCert                         
  $650 | Network Solutions                
       |                                  
  $850 | GlobalSign                       
  $930 | Entrust                          
$2,000 | VeriSign / Symantec              

* Note that Namecheap, DNSimple and sslpoint are resellers, not Certificate Authorities.

Namecheap offers a choice of Comodo/PostiveSSL and Comodo/EssentialSSL (though there is no technical difference between the two, just branding - I asked both Namecheap and Comodo about this - whereas EssentialSSL costs a few dollars more (USD$100)). DNSimple resells Comodo's EssentialSSL, which, again, is technically identical to Comodo's PositiveSSL.

Note that Namecheap and DNSimple provide not only the cheapest wildcard SSL certs, but they also have the least marketing gimmicks of all the sites I reviewed, and I am pretty sure I can say that DNSimple seems to have zero; hence for the convenience of others I am providing direct links to these two resellers:

share|improve this answer
    
Look at the price per instance - e.g. I can have 100000000000000 servers and pay to my CA only 1 price. Many CA's want money for every server! –  Arek B. May 28 at 21:55
1  
Maybe I missed it, but I did not see any reference to price per instance on the CA sites I looked at. I am hosting on Heroku, where my app is running on multiple dynos (virtualized Unix containers), and Heroku's SSL endpoint documentation does not mention anything about instances or dynos - so I suppose per instance pricing is not pertinent to my particular needs.. though of course others may find your comment insightful. Thanks anyway! –  user664833 May 28 at 22:16
    
Per-server pricing just doesn't make any sense. Once you have a certificate, you are absolutely free to export it from a computer and import it on any other one. –  Massimo Sep 1 at 21:22
    
@Massimo Per-server licenses used to be fairly common. Enforced just like you'd enforce an older Windows license - contracts and the honor system. –  ceejayoz Sep 3 at 13:50
    
@ceejayoz Ok, I was meaning there are no technical restrictions on installing the same certificate on multiple servers (and there are indeed scenarios where this is a requirement, f.e. load-balanced web servers). Of course, contracts can say otherwise. –  Massimo Sep 3 at 16:17

Since this question's been rudely resurrected, something that hasn't been mentioned is the reissue of certificates.

I didn't really understand what this meant until heartbleed came along. I'd assumed that meant they'd give you a second copy of your original certificate, and I wondered how disorganised one had to be to need that service. But it transpires that it doesn't mean that: at least some vendors will happily stamp a new public key as long as it happens during the duration of validity of the original certificate. I presume they then add your original certificate to some CRL, but that's a good thing.

Reasons you would want to do this are that you've corrupted or lost your original private key, or via some means have lost exclusive control of that key, and of course the discovery of a worldwide bug in OpenSSL that makes it likely that your private key was extracted by a hostile party.

Post-heartbleed, I regard this as a definite good thing, and now keep an eye out for it in future certificate purchases.

share|improve this answer

While price is probably a key issue, the other issues are the credibility of the provider, browser acceptance and, depending on your competence level, support for the installation process (a bigger issue than it appears, especially when stuff goes wrong).

It is worth noting that a number of providers are owned by the same top-end players - for example Thawte and Geotrust and I believe Verisign are all owned by Symantec - Thawte certs are, however, much, much more expensive than Geotrust for no compelling reason.

On the other extreme, a certificate issued by StartSSL (who I'm not knocking, I think their model is cool), is not as well supported in the browser and does not have the same level of credibility as the big players. If you are wanting to plaster "security placebos" across your site, it's sometimes worth going to a bigger player - although this probably matters a lot less for wildcard certs then it does for EV Certs.

As someone else pointed out, another difference may be the "crock of junk" that is associate with the cert - I know the Thawte EV Certs I was previously instructed to get only allowed for use on a single server, while the Geotrust certs I later persuaded management to replace them with were not only cheaper but did not have this limitation - an entirely arbitrary limitation imposed by Thawte.

share|improve this answer
3  
Provider credibility is pretty much meaningless. If it's got the padlock icon users don't care. If you're working with a Fortune 500 company with a security team they may require a particular vendor, but otherwise... who cares? As for StartSSL, they appear to be widely supported: "all major browsers include support for StartSSL" - en.wikipedia.org/wiki/StartCom –  ceejayoz Jun 3 at 18:15
1  
If a provider that does charges for revokation in light of heartbleed and them being hacked don't make a difference, and hours of downtime to regenerate certs don't damage a companies credibility then Startssl you are correct about credibility (I like startssl, but thats a different topic). While their browser acceptance is very high it is lower then other providers - see forum.startcom.org/viewtopic.php?f=15&t=1802 –  davidgo Jun 4 at 1:43
2  
How many end-users do you think a) check to see who issued a certificate and b) know about StartSSL charging for Heartbleed revocations? Hell, I don't check who issued an SSL. What they did sucks. The number of people you'd lose by using their certificates probably numbers in the single digits is all I'm saying. –  ceejayoz Jun 4 at 1:46

protected by Iain Sep 21 at 17:57

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.