Can someone explain to me the difference between a cheap SSL certificate and an expensive one please? Assuming they are both 128bit.

I personally believe there about the same as far protection goes Andrew - But someone more knowledgeable might confirm that however

But the more you pay, you get
* More $$$ coverage or warranty amounts
* Security Seals with your name, date stamped etc.
* Better Browser Compatability
* More Trusted Certificate Name

Basically, more $$$, more features.

Brad

Here are the two main differences:
1. Warranties
2. Use of a Seal on a site

Whats the difference? Nothing but the warm fuzzy feeling you get by shelling out more $$$

Technology - As stated they both are issued using a 128bit encrypted cypher and are just as hard to crack. These days if you look at the certificate closely in your browser you will find that 128bit is the minimum depending on the server architecture it may be 256bit or even higher.

Warranty - Most give you $10000 warranty as a base cover, I have NEVER heard of a certificate being cracked and anyone EVER make a claim. 40bit sure they can be cracked but 128bit I'm sure a determined cracker with 3 or 4 months and a mega server cluster would be able to bypass the system but by then they would find all these armed men waiting outside their front door.

Trust - This is the only difference when you pay the $$$ to the big boys you get a nice seal for your website stating that your website is secured by a certificate issued by them. For the really expensive ones you also have to prove who you are before you get issued with the certificate and this is another level of TRUST. You have proved who you are.


So what do you need?
You just need a certificate to secure access to a site for yourself as you want to protect some passwords that you are entering and do not want the information to be sent in the clear. Use a self signed or CACert freebee and put up with the warning notices.

You need to secure a site for a shopping cart, customers are making small purchases, $20 - $200 then they may not even know what SSL is. Get a cheap one that works without a popup warning and you are fine. Some even give you a site seal anyway.

If on the other hand the information being entered is of a very secure nature and Trust is a big issue then get one of the Pro level with a nice site seal that proclaims who you bought it from and should have a link back to their site so they can verify you. The job should pay enough to cover the extra cost and you can sell the extra cost to them by quoting all the trust issue stuff.

Thanks for the replies guys

What are these?


I just want to get one for my hosting site, we don't transfer CC details over it or anything, the most confidential data that gets passed around would be account usernames and passwords. I'm really looking to get it more for the image (ie people will see that we have an SSL certificate) rather than to protect much What do you think I should be looking for?

Edit: but we do eventually want to get CC details so something that would cover this for future use would be good.

The Self Signing Certificates are the Server Generated certificates.
i.e. https://www.yourdomainname.com.au:2083
Normally you get a warning that this certifiacte is not trusted - That is one of these certificates.

A RapidSSL certificate of similar is all you need Andrew !

Brad

Self signed certificates are when you generate the certificate on the server there is a whole process for it, it is also the certificate that gets used for WHM and cPanel secure access. CACert is http://www.cacert.org they will issue you a certificate for free based on their Root Certificate.

In either case the certificate will not be recognised by your browser as the Root or issuing certificate is not in the Trusted list (see there's that word again ). If the issuer of the certificate is not trusted the certificate is not trusted and you will get a warning box popup. Not good on a business site or if it happens for customers who will most likely think twice about completing the transaction if it happens.

One of the cheaper certificates like RapidSSL will more than cover you and will also be suitable when you do take CC info.

Thanks for the info

A little more info...

An SSL Certificate assigned by Verisign (expensive) for example, will be trusted by virtually every SSL capable browser, whereas the cheaper SSL certificates are often created by a Certificate Authority that has not been around for as long as Versign and is therefore not trusted by browsers with CA certs older than the initial companys CA cert assignment and distribution in the root CA cert kits in modern browsers.

I hope that makes sense - in basic terms it means that a Versign certificate for example will be accepted by 99% of browsers (even browsers as old as IE4), whereas others will only be accepted by 95% of browsers (such as only IE5 or IE6+)*. Negligable differences but worth mentioning, although if you're a web hosting company and your client is using IE4, it's probably not worth getting their business anyway!

Most providers will give adequate warranties and site seals anyway, irregardless of cost, but of course a neat little site seal can help add value to your e-Commerce site to reassure your site visitors that your site can be trusted.



* I can't recall the exact stats off hand, but these are rough guestimates that are at least close to the actual stats.

Cool, thanks

I don't think CACert will ever be trusted by IE, AFAIK the certificate authorities pay Microsoft money to be trusted by Internet Explorer.

I think I read somewhere that newer versions of Firefox will install trust certificates for CACert but than that only happens to tech savvy people who wouldn't mind a self signed certificate if they know the org.

Just my 2cents.

Geotrust seem to have a few different levels of certificates, which all just have different features. The certificates themselves are basically the same.

For example, the rapidssl certs I get for about $35. They're the same as the QuickSSL, but you can't reissue them. That means if you've got a problem with the certificate, you basically have to buy a new one. QuickSSLs cost me $100, and it's probably worth the extra money if you don't know what you're doing. They have other levels of certificates as well, like a QuickSSL premium which gives you a little picture with the time. They cost me about $180. I can't justify that cost. There's another one, called a BusinessID or something. They're about $200 and the major difference is your business name is in the certificate. I'm not too sure of the point of that, but then I don't sell too much online. RapidSSLs work well for me.

I tried to buy through geotrust directly for a while, but found that them not being available during the day was a problem. Plus they were more expensive than who i'm getting them through now. I guess they have different pricing points for different volumes.

I just use www.godaddy.com - only US$20 for a year for an SSL cert that works with all browsers. No seal or anything, and I probably wouldn't use them for a high volume site, but for most sites they're fine!

Why throw away the extra us$80 or more for something that's essentially the same product?

Different people require different things, that's why I included all the certs that I've used. Some people ask for the site seal. You don't talk a customer out of something they want just because it's more expensive

The pricing I get for cheap certs at is $35au and includes support. You don't always need support, but if something weird goes on, it's good to have a phone number for someone who isn't state side.

So where should we be buying here?