1

Do free or paid SSL certificates have anything to do with their security grades from a testing service such as SSL Server Test by SSL Labs or does it all depend on server's security configuration?

4

Nope. There's absolutely no difference between a free and paid cert from a security or cryptography perspective. And much of the security grade actually depends more on the web server configuration (allowed cipher suites and such) than the specifics of the certificate.

  • 1
    In fact, most of us trust Let's Encrypt (a free vendor) dramatically more than, say, the paid vendors Comodo or Symantec. – ceejayoz Jan 9 at 17:58
1

Issuing of those paid SSL certificates which sport the so-called "Extended Validation" ("EV") support (shown as "green address bar blurb" by some browsers) does indeed include performing — to some reasonable extent — verification of the fact the prospective holder of the certificate is indeed a commercial entity claiming to have the Canonical Name to be assigned to the certificate to be issued.

Such verification usually requires the commercial entity to be registered in the conutry-specific (semi-)official "yellow page"-like registry, and the ability of several executive persons of that entity to be contacted via landline phone numbers.

Still, it worth stressing that this is all about social things. As far as "the math" behind the security of X.509 certificates is concerned, EV certificates are absolutely no different from any other certificares (even self-signed, created, say, by running certain tools of the openssl toolset).

Yet on the other hand, there is another social issue: if the certificate is to be used not only to provide encryption but to "present" the service to end-users — with the publicly-available web servers being supposedly the best example — then the entity issued the certificate may be important. The reason is that the users use Internet browsers to go to websites, and these browsers either maintain their own lists of trusted root (and a set of tier 2 and may be 3, that is, subordinate) Certification Authorities, and/or access the system's list of such CAs. Consequently, if you generate your own certificate and stick it to your web server, no matter how "good" mathematically your cert is, the user's browser will barf at it with the Big Red warning about an insecure connection: simply because the list of "known" CAs it sees does not include the CA which issued your cert.

TL;DR

  • Paid certificates are only good if they are of the EV type.
  • They are only better than others as long as the social aspects of using the certificates are concerned with.

Oh, and while we're at it, note that sometimes providers of paid certs do horrible slip-ups, and this leads to the certs of their CAs being dropped from the lists of trust of popular browsers.

  • 1
    It is notable that many in the industry consider EV certs to be dead both because browser vendors have started removing the visual indicators that differentiate EV and because most of the largest websites on the Internet don't even use them. – Ryan Bolger Jan 10 at 3:12
  • @RyanBolger, I trust you on that, but from where I stand the situation looks a bit different: pointy-haired bosses do not usually concern theirselves with such stuff, and to get a contract to provide some *aaS to another business, the website powering your shit has to have that "fancy" cert — precisely to look good and super-robust when you present it to decision-makers. So, to reiterate, this is a social thing. Sad but true. ;-) – kostix Jan 10 at 9:36

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.