How to choose the right SSL Certificate for the appropriate level of security (verses the money)

take a look at this ssl vendor: geotrust

http://www.geotrust.com/ssl/compare-ssl-certificates.html

This is what we use in our company. Their public key certificate is included in all webbrowsers so there is no problem using them.

For a single site use either

QuickSSL® $249 or
True BusinessID $399

per year.

Tolomir

More info about them:

GeoTrust® is the world's second largest digital certificate provider. More than 100,000 customers in over 150 countries trust GeoTrust to secure online transactions and conduct business over the Internet. Our range of digital certificate and trust products enable organizations of all sizes to maximize the security of their digital transactions cost-effectively.

Tolomir:

You wrote:

>> Our range of digital certificate and trust products enable organizations of all sizes to maximize the security of their digital transactions cost-effectively.

I would love to understand some of the reasoning behind the price options.  Your suggestion raises even more concern/interest because why would GeoTrust be able to do for $400 what Verisign does at $1,500.

I'm not sure if GeoTrust offers 128 bit at $400 but I'm assuming it does based on what you said.  Either way, what is your take on price verses security?

Thanks!

Am I correct that GeoTrust only offers 'up to 256-bit' encryption?  If so why would a company want to take a chance with 256 when they could purchase something higher?

Thanks

Well verisign sells their name, ever looked for sportscars? There are cars that drive like Porsche, but buying a Porsche is still something special. With geotrust you can get their premium product for $899, so there is not such a big difference...

They offer 256 bit which is of cause more secure than 128 bit encryption.

The encryption is based on what a web browser has to offer - old browser support 40 bit, newer up to 1024 or more bits. SSL encryption means webserver and client exchange data over a secure channel, the ssl provider signs your public certificate with his private certificate, you pay for the name.

---

There are to basic certificates: Validation per site or validation per id card. A site validation can be ordered by someone from it staff, the validation per id card has to be signed the big boss. He signs with his name that the site is valid and speaks for the company.

SSL certificates are made to offer trust in the 1st place and the more you pay the more trust they spread (if a user ever(!!) checks the certificate behind a https connection...) In the 2nd place they provide security but for that you can take the cheapest with 256 bit encryption...

Tolomir

Let verisign answer themself

http://www.verisign.com/ssl/ssl-information-center/strongest-ssl-encryption/index.html

Protect Customers with the Strongest Possible Encryption
Because Web site visitors cannot easily determine the encryption strength of a given session, they depend on the site owner to protect them. True 128-Bit SSL Certificates enable every site visitor to experience the strongest SSL encryption available to them. VeriSign is the leading SSL provider of SGC-enabled SSL Certificates, enabling 128- or 256-bit encryption to over 99.9% of Web site visitors.

Tolomir,

I won't drag this out much longer.  I wasn't quite sure how to interpret your last post.  Can you clarify?  On the one hand I realize you were pointing out how we pay for a name and not necessarily a difference in product.  On the other hand, I wasn't sure how to interpret the 'bold' :

             enabling 128- or 256-bit encryption to over 99.9%

I contacted a sales rep from GeoTrust.  They referred me to someone whom I'm currently waiting on.  The first person I talked with asked how many domains I would be supporting and since I had more than one (about 5), they wanted to know if they were sub domains or separate.  We have both (subdomains and separate).

Can you say anything about how those last two questions impacts our decision making or purchasing options?

Thanks!

I just wanted to point out, that even verisign considers 128 bit (or even 256 bit) encryption as safe. There is no need to have a higher security.

---

Well they can offer you a wildcard certificate then.

SSL Certificates: True BusinessID Multi-Domain Secure up to 25 domains on a single server. $599 for each server.

>> I  just wanted to point out, that even verisign considers 128 bit (or even 256 bit) encryption as safe. There is no need to have a higher security.

This was my mistake.  My mind was twisting numbers.  I saw the 256 as being lower than the 128 - go figure.

Anyway, appreciate all the input!

Ok, now I understand:

"I realize 128 bit would have to be better than 256 bit - but again, why?  What would be a few good examples of why I should choose something higher than 256 bit?"

Do you agree:

1)  That standard SSL certificates rely on end user browsers to determine the encryption level that our SSL Certificate will offer?

2)   SSL certificates are made for 'intranet' purposes only and were not created for public websites?

3)  Server Gated Cryptography certificates will take older browsers with 40bit & 56bit encryption and step them up to true 128bit encryption?

1) Yes - this could be even 40 bit (that is lower than 128 ;-) - I think IE 5 came with it due to export restrictions...
2) No this is wrong. Take amazon, I insist that any of my orders are encrypted to possible traffic sniffers: Data privacy protection is the keyword here
3) Interesting, take a look at wikipedia: http://en.wikipedia.org/wiki/Server_gated_cryptography - so your assumption is wrong.
If you are concerned about security I suggest you use a switch in the html code to block all webbrowsers (that are not a a whitelist) that cannot deal with 128+ SSL security

>> 3) Interesting, take a look at wikipedia: http://en.wikipedia.org/wiki/Server_gated_cryptography - so your assumption is wrong.

Actually the article is not saying that SGC technology is weaker.  What it's saying is that legislation was inacted to accomodate the weaker browsers.  The SGC technology apparently brings the weaker browsers up to a higher potential or longer key.  Without the SGC technolgoy those weaker browsers would simply be cut off - according to the article.  In otherwords, first the US enforced very strong encryption, but institutions outside the US could not do transactions with the US.

Thus, through US legislation, SGC was created for banks outside the US.  Now you know and I know the US government was NOT  saying, " let's lower our standard and make it more risky to do transactions with *banks* outside the US because it's better to lower our security than to lose money."

Not no, a thousand times no!!  What the article is trying to say (but was poorly worded), that the US went out of their way to find a solution that would make bank transactions feasible for banks outside the US.  Nobody else was included in on this extra effort.  Nobody else could get in on this solution which brought lower bit browser up to the highest bit possible.  However, in time the US opened up the SGC technology to anyone.....

Now, back to my last question, how does GeoTrust offer the SGC technology, or does it?  The answer is no, they don't offer it.  They offer the highest encryption but leave the *server configuration*  (for low handshake scenarios) to the company.  By server configuration, this is the point you were making by including a switch to block all web browsers not on the whitelist.

Thanks for all the feed-back!