Re: Question on SSL Certificates

[Alfredo Delgado <adelgado@xxxxxxxxxxxxxxxxx>]

Mike,

You're paying for a string of characters and a promise to the customer 
that if they trust the company who sold you your certificate then they 
should trust that said company did a good job of authenticating that you 
are who you say you are.

In practical terms you want the user's browser to show a lock or whole 
key or whatever it uses as a sign of encryption instead of a warning. 
Make sure you get your certificate from a company whose root certificate 
is included in common browsers. i.e. The browser makers trust this 
authenticating agency.

I don't think this has changed but http://www.thawte.com/ used to be 
Verisign's price competitor and Verisign bought them and kept them on as 
a value brand.

I've purchased cheap certificates from http://www.geotrust.com/ -- they 
purchased Equifax's digital cert biz -- and installed them on an i5 with 
no problems.

I do not believe that the majority of users are so paranoid or web-savvy 
that they'll really appreciate or feel more safe if they see Verisign's 
branded badge on your web site. I consider this purchase to be in the 
realm of domains. If GoDaddy can register a domain for you for $8 then 
don't expect the bits to be magnetized any stronger if you pay $30 to 
Network Solutions for the same thing.

Thanks,
Alfred

Mike wrote:

> We are shopping for SSL certificates but I have basically no experience with
> them. We have a site that allows citizens to pay their water bills. Looking
> at Verisign they have several options (
> http://www.verisign.com/ssl/buy-ssl-certificates/secure-site-services/index.html).
> Now I could go the cheap route and get the cheapest there is, but we are
> talking about a government site. I want to make sure we get what we need and
> not just the cheapest option.
>
> Note: My boss seems against anything GoDaddy related, so that is out.
>
>