Where should I get my SSL certificate from?

[Guest 33003]

Made the evidently foolish decision to bag an SSL certificate from GoDaddy a while back.

Now I find out that when I link to content on my server using https: browsers don't like GoDaddy SSLs - comes up as 'unknown certificate provider' or something like that.

So where should I get a certificate from that'll be accepted by browsers?

Can't quite believe this is occurring to be honest. What's the point of selling an SSL certificate that gives browsers problems like that?

[bbevan]

Not much of an expert on these things, but I'm told the provider of your certificate can make a huge difference to its credibility...

Try http://www.verisign.com/index3.html they've been in the game for years, so would make a good starting point

There was a big thread about this a while ago, something to do with syncing mobile device with an Exchange Mail Server, have a dig about you might find it

[Guest 993]

VeriSign are huge. They are more than just a signing authority, they run and control a fairly major chunk of the Internet backbone (including several root nameservers and the .com and .net top level domains) with ambitions to control far more. Were recently involved in a bit of controversy by redirecting non-active or non-existent domain requests to their own sites.

Thawte is the other major one... who are also owned by VeriSign

Then there's GeoTrust... yep you've guessed it, also now owned by VeriSign

They're all the ones of any repute. Note that the likes of Microsoft back them so guaranteed to have the root certificates in your browser and no problem authenticating anything signed by these guys.

[Guest 3966]

Thawte one from here less than 50 quid works fine on my exchange 2003 for owa, rdp and activesync without having to install any certs on client devices.

http://www.thawte.com/ssl123/google....FQnclAod6gEF9Q

[bigsimes]

We switched from Verisign (expensive) to Geotrust (good n cheap). Now as DeadKenny says Geotrust are part of Verisign. However they trade independantly and I think their certificate prices are reasonable...

[KennyVader]

I used to recommend GoDaddy certs as they were cheap and worked (even on PDAs) however they recently changed from listing Starfield as the ultimate authority to listing GoDaddy themselves. Since the idiots changed that, I can't get GoDaddy certificates to work on anything without a lot of hassle. Because as you say, GoDaddy is not in the trusted root provider list of (m)any browsers. They seem to be either too stupid or too vain to realise that this makes their certificates pretty much useless so they are to be avoided at all costs now. Good on the other recommendations.

[Guest 10361]

Agreed. My GoDaddy cert is pretty much useless. Will go with 1 of the other recommendations. Thanks.

[Kryten]

GoDaddy should be valid still if you have updated your root certificates in your browser from Windows Update. Their intermediate CA cert is valid until 2026 and their root CA until 2034

EDIT: That is in both IE7 and Firefox 2.0 I just checked

[KennyVader]

Originally Posted by Kryten

GoDaddy should be valid still if you have updated your root certificates in your browser from Windows Update. Their intermediate CA cert is valid until 2026 and their root CA until 2034

EDIT: That is in both IE7 and Firefox 2.0 I just checked

Yep but this doesn't help other browsers, PDAs, mobile phones etc that often need a firmware update or indeed a totally new model before they get an updated root certs lists. The point is that it was fine when they were root-certificated by Starfield Certification Authority, and now they've had what looks to be little more than a cosmetic change so they say "GoDaddy" instead, lots of stuff is now that tiny little bit more awkward to mean "don't use GoDaddy any more". What's possibly worse though is that GoDaddy don't seem to understand or care that they've broken what was previously a good product at an excellent price from them; do you really want to entrust your SSL requirements to an organisation that doesn't understand or care about making this sort of unannounced change and it's effect.

[fabbers]

Hi all, I'm in the process of switching to a proper cert from self signed but need one that work with Nokia Mail for Exchange on the E61. Anyone got any experience with the Thawte SSL123 certs?

[Guest 3966]

yup I use one and worked straight off the bat on our exchange 2003 box for OWA, Push email for WM6 and RPC over https and RDP over https

[fabbers]

Cheers for that, i've seen posts that they're fine with windows mobile but apparently Nokias activesync equivelant is a bit picky.