Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been wondering for a long time about is. There are many certificate authorities having different types of certificates. But even certificates of the same security level cost a lot more with one certificate provider than with the other.

I'm aware that there are many types of certificates, but even certificates of the same security level cost a lot more with one certificate authority than with the other.

For instance rapidSSL offers certificates at 50 dollars, but if you want the equivalent from Verisign you pay 10 times that amount.

I'm just wondering what the difference is between all the authorities. Is it just a marketing strategy, because people think: "The more expensive, the more secure?".

share|improve this question

3 Answers 3

up vote 9 down vote accepted

Some possible reasons why a CA might be able to charge more than a rival:

  • They have a better reputation.
  • They have better customer services.
  • They are trusted by all the browsers out of the box.
  • They do better and more expensive due diligence of the companies they issue certificates to.

(This last one is irrelevant in practice, since almost everyone just accepts the CAs that come with their browser without question, but I expect a CA might cite it as a reason they have to charge more!)

I use one of the more expensive vendors myself, as it happens, but I'm quite happy to pay the few dollars extra because the customer service is very good. I screwed up an urgent certificate renewal once, and they answered the phone promptly, figured out where I'd gone wrong straight away, made sure I didn't notice them rolling their eyes at my stupidity, and got a replacement cert to me within 5 minutes. That's worth a few bucks a year more, I reckon.

share|improve this answer
1  
But rapidSSL is present in 99% of the browsers too, there still is such a price difference. But true, support is important. –  Lucas Kauffman Mar 28 '12 at 11:28
    
Agreed, if a CA isn't in all the major browsers then it doesn't matter how cheap they are: you're not going to want to use them. (After all, if you can easily deploy a new CA to all your users, then why not just self-sign for free.) –  Graham Hill Mar 28 '12 at 12:59

In practice, commercial CA are all about branding. The biggest asset of a CA is how much it is trusted, and trust is a flitting thing, which verges on the irrational. Normal market behaviour is that the more you charge for an item, the fewer items you sell, but with trust, things do not work that way. It may happen that you may sell more certificates if you charge more for them, because the higher price will trigger the subconscious equivalence "expensive = secure". Correspondingly, even if you give away certificates for free (like StartSSL does), you will not necessarily hijack the whole market: for a security-related service, many people fear low prices.

The same phenomenon has been observed in other domains. In the late 1990s, BIC, the famous pen and lighters manufacturers, tried to mass-produce and sell cheap perfume, with outrageously low prices. It did not work at all. Perfume seems to be one of these markets where things have to be expensive.

share|improve this answer
    
I'm of the opinion that StartSSL could nearly kill the SSL market if they were to offer an even remotely usable interface. Save $10, but pay for it with 4 hours of your time. –  tylerl Nov 26 '12 at 2:30
    
Also... last time I got a certificate from StartSSL, they signed the wrong key. Don't know where they got the key, but the public key in the cert did not match my private key. I was flabbergasted. –  tylerl Nov 26 '12 at 3:55

For standard SSL certificates, my feeling is that the only real differentiator is browser support (althought I'd agree with @graham's point around customer service). As long as the CA is trusted, the certificate will work fine.

The market has tried to differentiate with EV-SSL certificates, where the CA will do more significant checking on the applying company before issuing a cert.

For me, the problem with this model is that most users don't know the difference and wouldn't notice if they went to a site one day and it had EV-SSL and the next it just had a standard cert, so really I'm not sure that they're worth paying extra for.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.