SSL certificates - your recommendations?

[cava83]

Hi there,

Need a recommendation please,

Mobile devices, one domain, exchange, outlook on the go.

Verisign, good brand, bloody expensive.

I have come accross DigiCert, they look good, never heard of them.

What are your thoughts?

Thanks,

G.

 

[Longy]

godaddy

http://www.godaddy.com/gdshop/ssl/ssl.asp?ci=9039

 

[Darren S]

Hi there,

Need a recommendation please,

Mobile devices, one domain, exchange, outlook on the go.

Verisign, good brand, bloody expensive.

I have come accross DigiCert, they look good, never heard of them.

What are your thoughts?

Thanks,

G.

True - but they are good. Used them here for a few years now.

D.

 

[crazycup]

RapidSSL ?? Offer free trial etc

 

[FlamingMonkey]

instantssl.com from Comodo, good value

 

[Dafthead]

instantssl.com from Comodo, good value

+1

We've got a wildcard cert for our entire domain, it PWNS

 

[JackoR26]

I used Globalsign for our OWA certificate

Cost us £525 for 3 years

 

[iain187]

in a brief summary, what do they do? please enlighten me as i am uneducated

 

[JackoR26]

in a brief summary, what do they do?

Encrypt the data between the host and the client

 

[KDF]

Encrypt the data between the host and the client

Or more accurately provide a certificate that is properly signed by a registered authority to allow you to do that.

 

[Mike_182]

Or more accurately provide a certificate that is properly signed by a registered authority to allow you to do that.

What he said.

Godaddy is the way forward. It's only a matter of time before Verisign realise why nobody's buying their certs. They're not the only company in the world that can do 'proper' certs - even EV certs - yet they charge like they are.

Fools TBH.

 

[cava83]

Go daddy is much cheaper than all the others.

What package do you recommend ?



Thanks for all the input,

G.

 

[Mike_182]

The minimum that you require. If you need EV, get EV, if you just need a cert to stick on a secure web site, get the cheapy.

What you using it for?

Oh, and GoDaddy is great because it's all actually in Internet Explorer already!

 

[cava83]

exchange - outlook
mobile devices

 

[sn00p]

exchange - outlook
mobile devices

Is it all internal? If so why not just create your own CA and put your root certificate on your computers/devices?

 

[Mike_182]

Arse of deployment.

Cheapy godaddy job. Win.

 

[cava83]

:rasp: Because i will have to create the certificate and put it on all the devices, managers are in different buildings, not always in the uk, plus I like the easy option

Internal staff, yap

Is it all internal? If so why not just create your own CA and put your root certificate on your computers/devices?

Mike, cheapy, job done.

Cheers buddies, can't believe how much cheaper go daddy is, wicked.

Lots of love,

G.

 

[DMS]

Sounds like all you'll need is a basic web server certificate. A cheapo one will do the trick just fine. As long as Windows trusts the root CA it doesn't really matter who you get the certificate off so go for the cheapest you can find. GoDaddy are very cheap as has already been mentioned. Trend Micro were running an offer on SSL certificates not long ago, I don't know if that's still running too?

Think yourself lucky you don't have to manage PKI's day in day out. I've spent all day today configuring distribution points for CRL's on a new customer's network. Quite hard to get your head around when you've got over 70 sites configured, 12 child domains, an intra-forest trust relationship and an external trust relationship to contend with.

 

[The Hoff]

Haven't looked at certs since last year. Last I recall reading, MD5 SSL was cracked.

What have they done to circumvent fake certs?

 

[DMS]

Yeah, certificates that had the private key encrypted with the MD5 algorythm could be spoofed. It uses a collision attack on the MD5 hash function to produce 2 identical X.509 certificates that contain the same digital signature but with different private keys.
A rogue CA could be set up to create these certificates which would be trusted by all common browsers because their pre-installed public keys could decrypt the private keys generated by the spoofing process.
The simple way around the problem is to encrypt your digital signatures using 3DES or preferably SHA-1. As far as I'm aware nobody has managed to crack SHA-1 yet. Unsure about 3DES.

 

[cava83]

Darren,

Rather you than me, sounds a bit too much nevertheless, would be interesting to learn, very much so.

Thank you for your input and everyone else too,

Kindly appreciated,

Gabi.

Sounds like all you'll need is a basic web server certificate. A cheapo one will do the trick just fine. As long as Windows trusts the root CA it doesn't really matter who you get the certificate off so go for the cheapest you can find. GoDaddy are very cheap as has already been mentioned. Trend Micro were running an offer on SSL certificates not long ago, I don't know if that's still running too?

Think yourself lucky you don't have to manage PKI's day in day out. I've spent all day today configuring distribution points for CRL's on a new customer's network. Quite hard to get your head around when you've got over 70 sites configured, 12 child domains, an intra-forest trust relationship and an external trust relationship to contend with.

 

[bigmouk]

I've used these for a few years if you need any other options ..

http://www.rapidssl.com/index_ssl.htm