Re: Question on SSL Certificates

["Walden H. Leverich" <WaldenL@xxxxxxxxxxxxxxx>]

> Note: My boss seems against anything GoDaddy related, so that is out.

Godaddy isn't a root signer -- they're selling certs signed by valicert
which redirects to tumbleweed, so that's a slippery slope. 

The two I've had success w/are Verisign and Thawte. Thawte is regularly
less expensive than Verisign, but Thawte is South African, while
Verisign is American -- for a corp, not a big deal, for the
government... <G>

Also, be aware there is a new feature of SSL certs, called EV, or
Enhanced Validation. If you're using an EV-aware browser then your
address bar will be green otherwise it won't. IE7 is an EV aware
browser, and I'm sure firefox, opera and safari will be soon.

In any case, any 128-bit SSL cert will provide the same level of
protection from hacking regardless of who the provider is (even one you
issue yourself). The difference is the trust your users have in the
cert. If you self-issue it's cheap (free), but the browser will say it
doesn't recognize the Root CA in a message box, and that would scare me.
The EV stuff provides more protection to the consumer, as they can
better trust that the site is who they claim to be, but I don't think
that's a big deal in your case. So... I'd go w/Secure Site Pro from
verisign or SSL123 from Thawte (look at price difference!) 

Of course, there's also the "trust" factor, I'd gues Verisign's SSL seal
is the most recognized, so if you're trying to put your customers mind
at rest I'd go w/Verisign, but from a true security point of view
they're all the same.

-Walden