Because domain-validated certificates may scare Comodo Dragon users.
Consider these five tiers of HTTP security (not an official list):
- No TLS (
- TLS with a certificate that is self-signed or from an otherwise unknown issuer
- TLS with domain-validated certificate from a known issuer (organization not part of certificate)
- TLS with organization-validated certificate from a known issuer (organization name in certificate)
- TLS with Extended Validation certificate from a known EV issuer (organization name and address in certificate)
Certificates that you buy from a commercial CA will be 3, 4, or 5. Most web browsers allow all but 2 with no interstitial warning, even though 2 is better than 1 in resistance to passive attacks. But the Comodo Dragon web browser warns on 3 as well. It displays an interstitial warning screen when viewing any HTTPS site that uses a domain-validated certificate, which begins as follows:
It may not be safe to exchange information with this site
The security (or SSL) certificate for this website indicates that
the organization operating it may not have undergone trusted
third-party validation that it is a legitimate business.
This is intended to stop attackers who register a domain
bankofamerrica.example for "Banko Famer Rica", put up colorably legit content about Costa Rica, buy a certificate for that domain, and then change it to a site that impersonates Bank of America.
But it's been seen to display this message even for Facebook.
To not scare users of Dragon, you need to avoid domain-validated certificates. But you don't need to buy an EV certificate. Just make a list of CAs willing to sell your organization an organization-validated certificate whose root certificate is in all major browsers. Then there's no technical security reason not to buy the cheapest one.
If you're operating your blog as an individual, you may not qualify for an organization-validated certificate from any CA. In this case, you just have to live with the warning in Dragon, and you can just go with a cheap domain-validated certificate like the one StartSSL offers.