1

I'm trying to make an https version of a shopping cart website that sells bicycle gear. Before, I hosted my website on a shared hosting provider and all I did was contact tech support to enable https. I remember it only cost me about 50$/year.

Now I'm migrating the site over to a VPS and trying to set up https myself. I generated a private key and a CSR. When I went to a site like verisign, there are different types of "signing" each over 400$/year. So my questions are:

1) why is there this price difference?

2) am I allowed to re-use this certificate for more than one domain name?

3) am I supposed to buy a commercial ssl for my site in the first place? (I heard there are other free options for https websites, are they applicable to my bicycle shop website?)

EDIT

to clarify on item 3, I read about three types of ssl on linode.com library:

a) self-signed ssl b) ssl using subjectaltname c) commercial ssl

Should my bicycle shop use a, b or c? Also, My bicycle shop currently uses the magento e-commerce web application.

Improve this question

2 Answers 2

Reset to default
3

1) There are much better (read: cheaper) places to get SSL certs. Go Daddy has an intro price of $30/year (https://www.godaddy.com/gdshop/ssl/ssl.asp)

2) No. You can get a (very expensive) wildcard certificate that could work for www.bikestore.com as well as shop.bikestore.com, etc

3) Well, if you want to take credit cards, then you need SSL. You could go with a company like paypal that does all of the processing for you, and uses their own site to do it, so you don't have to deal with setting up a secure site only to have it hacked by a vulnerability in the shopping cart software.

Edit

Don't use a self-signed SSL certificate. As phoebus says, they're for testing or internal use, and no one trusts them.

Get a commercially signed certificate from someone cheaper. There are lots of companies out there. I was thinking about getting a certificate for my blog and here's the ensuing thread: http://www.standalone-sysadmin.com/blog/2009/10/ssl-enabled-for-the-blog/

Improve this answer
4
  • oh ok, thanks. I just added an edit to my question inquiring what "type" of ssl I should get. Can you suggest something? Thanks
    – learningtech
    Dec 11, 2009 at 14:20
  • 1
    If you use a self-signed SSL, users will see a warning every time they go to your site, that it might not be who it says it is. Self-signed SSLs are only for internal and testing use, not for a public-facing site.
    – phoebus
    Dec 11, 2009 at 14:38
  • +1, I would give serious though to the paypal recommendation, Amazon provides a service like that as well. Not only does that take a lot of pressure off, it also can be nice for end users, I my self will pay a little extra at amazon not to have to fill out yet another form ... :-)
    – Kyle Brandt
    Dec 11, 2009 at 14:50
  • I just wanted to add a comment that says not to pay $400/yr for an SSL certificate. Those companies sell snake oil - the $30/yr certificates work just as well as the $400/yr ones as far as encrypting the data between browser and server. I pay about $11/yr for mine at wholesale. Wildcards are about $150/yr wholesale.
    – Dave Drager
    Dec 11, 2009 at 18:44
2

To answer your edit: you should use a regular commercial SSL. If you plan to use subdomains and need to secure them you will need wildcard SSL. Keep in mind, if you plan to accept credit cards you may need to comply with PCI-DSS Standards.

Also, though someone mentioned Godaddy, I'd advise to stay away from this company, as much as possible. There are better ones, like NameCheap, which also sits in at under 15$ for a regular SSL for one year.

Improve this answer
1
  • I have had a good experience dealing with NameCheap.com for domain registration.
    – Agvorth
    Feb 13, 2010 at 13:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .