Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We're about to release a service that requires website owners to embed our javascript code on their site which will then serve the script from our server similar to Google Analytics. (yes I'm aware of the security implications)

We obviously need SSL for this because it'll be embedded on SSL enabled websites so I'm looking for the SSL certificate authority with the best possible browser compatibility. I'm wondering if any research has been conducted on this subject that has real data to backup the claims. I hear a lot of people saying its very similar between the big players but I've never seen the data to back it up especially in our case where 0.01% comparability difference is a big deal.

share|improve this question
    
I thought the idea that all SSL certificates were more or less created equal. This certainly is when I view a website that makes a secured ssl connection. Yes, I understand the authority that issues that SSL Certificate can have different levels of truth. This does not seem to be his question. –  Ramhound Dec 8 '11 at 17:37
1  
@Ramhound Browsers contain a list of Certificate Authorities that they trust, if a user has an old browser which doesn't support the certificate authority that issued the certificate you'll receive an error. So I'm asking which Certificate Authority has the best compatibility. –  Sean Bannister Dec 10 '11 at 6:17
add comment

2 Answers

And Since it has been unveiled that VeriSign was breached multiple times in 2010, which btw also ownes Thwate and Geotrust, i think ENTRUST is the only brand to trust.

share|improve this answer
1  
As a service provider, who you trust doesn't really matter. It's who your users trust, which most of the time will be what comes bundled by default. (If you don't trust Verisign as a user, did you remove their CA certs from your browsers?) –  Bruno Feb 23 '12 at 10:52
add comment

Verisign was in the certificate business from literally the very beginning, and for that reason alone is your top contender for most widely accepted across all devices, versions, technologies, and usage cases. They currently control somewhere around 40% of the SSL certificate market (when you include their other assets like Thawte, according to wikipedia), so a device that does not trust Verisign certificates would be considered "broken" by consumer standards.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.