Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a commercial site and wanted to change to SSL at least for the logged in users. Hoping someone can provide some advice:

  1. I only have one domain, but ideally I'd like to test on our development server before I go forward with this. Do I need to get 2 certificates?

  2. I was going to go with GoDaddy as the price is right but not really sure why it is so much more affordable than the other options. Perhaps that is a red flag? If I do go with them do I select the multiple domain option so I can test on my development server first? I hate paying extra when I only want it for one site but that looks like my only option?

Thanks in advance.

share|improve this question
1  
Why not use a CA like StartCom that offers free certificates? (There's a classic post on one of the SE sites about how the more expensive CA's offer "premium" multiplication.) –  David Schwartz Jan 31 '13 at 21:22
    
@DavidSchwartz Free is always good. Didn't know they were CA. Not sure I should use this for my production site thou? –  Tom Jan 31 '13 at 21:45
    
If you think they're worth more, feel free to pay more for them. –  David Schwartz Jan 31 '13 at 22:07
    
Doesn't sound like they should be used in production sites: The "StartCom Certificate Policy & Practice Statements" document §3.1.2.1 is explicit that the Class 1 (free) certificates are for non-commercial uses only. –  Tom Feb 1 '13 at 21:31
    
Did you know the box of Q-tips says you should never insert them into your ear canal. –  David Schwartz Feb 1 '13 at 21:58

1 Answer 1

up vote 2 down vote accepted

An SSL Cert (with some exceptions/special cases) is always bound to a domain name, so you can get away with 1 SSL Cert in some scenarios -

  1. If the Development server has the same domain name as the live server (eg if you use DNS to force your browser to different paths) it will work OK. [ If you think about it, this makes sense, big players like Google who have their content distributed on multiple boxes with the same domain name only need 1 SSL key, even though its on multiple boxes ]

  2. If the Development server has a different name to the live server you can still use a key signed by a registrar, but it will throw up an error saying the domain name being addressed does not match the one in the cert. You can simply accept this message.

Another way to handle the problem would be for you to generate a Key for your web server, but instead of (or in addition to) creating a CSR (which is a request for a registrar to sign your cert), you can self sign your cert - again you will get a message popping up that it was self signed, but it will work fine for testing purposes. [ If you get more sophisticated, you can actually create your own registrar for internal use and add yourself as an authority for your development machines - then you can create as many certs as you want for test purposes - without any errors (after you have added your registrar cert to your dev boxes ]

I have used StartCOM for a couple of my live boxes for a few years, with no problems. They are a good idea in as much as they force you to think and understand the whole SSL signing and trust process better then most registrars. OF-COURSE, THIS MAKES EVERYTHING HARDER TO GET WORKING INITIALLY. The disadvantage, if I recall correctly is you can't use them (ie free ones) in the name of a company, only your name. This is probably not that big a deal - unless you want something fancy like an EV Cert - in which case StartCom are, unfortunately, not the cheapest option.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.