I normally used self-signed certs, however now I need a proper one at absolutely minimal cost.
Since creating a "certificate authority" with
makecert really just means creating a public/private key pair, it seems pretty clear that creating a public/private key pair from such a "certificate authority" really just means generating a second public/private key pair and signing both with the private key that belongs to the "certificate authority".
Since the keys are signed anyone can verify they came from the certificate authority I created, or if Verisign gave me the pair they sign it with one of their own private keys, and anyone can use Verisign's corresponding public key to confirm verisign as the source of the keys.
Given this I don't understand why Verisign or Godaddy only have rates for yearly plans, when all I really want from them is a single public/private key pair signed with one of their private keys.
Clearly I am misunderstanding something, what is it? Does Verisign retire their public/private key pairs periodically so that my Verisign signed key pair "expires" and I need new ones?
Edit: I learned that the certificate has an internal expiration date and it also maintains an internal value stating whether it can be used to sign other certificates (i.e. sign other private/public key pairs stored as certificates). Can't I get a few (even one) non-signing certificate signed by someone like Verisign that I can use for authentication/encryption without a yearly subscription?