[SAGE] Re: Are cheap SSL certificates legitimate?

[seph <seph@directionless.org>]

"Philip J. Hollenback" <philiph@pobox.com> writes:

> But in this case I think I have to pay for something.  Otherwise I
> will have to spend a large amount of time configuring all the
> different clients and operating systems.

This is easier than you make it sound. But I haven't bothered setting
up an office CA, so I'm not really one to talk.

> Thus I really want to know if these 'cheap' certificates are
> sufficient and I'm not somehow opening myself up to some sort of
> security problem later on.

It's PKI. If your clients already trust that CA, then you're already
vulnerable to errors from them.

Chained certs shouldn't be visible to the clients, they're just a bit
harder to install and deal with on the server side.

FTR I use rapidssl because they're the cheapest thing I'd found whose
CA is trusted by everything I need. I haven't had any problems.

seph