2

I was looking at the SSL certificates offered on A2 Hosting and I see they have something called a "GlobalSign OneClick Alpha" certificate which is less than half the price of the "GlobalSign OneClick DV" certificate. AFAIK all SSL certificates are at least domain verified - so I contacted the sales team at A2. Here's their response.

The AlphaSSL certificates are not verified on a domain, organization, or extended basis.

Is there such a kind of unverified SSL certificate? How does it show up to an end user in the browser? (Meaning - do I still get the lock icon if I use this "alpha" certificate)? FWIW I also went on GlobalSign's website and they do not list any information about providing a "OneClick Alpha" certificate.

Improve this question

5 Answers 5

Reset to default
3

Seems like nonsense from the A2 support. A certificate that's not even domain validated only carries as much trust as a self signed certificate and self signed certificate is not worth anything to pay.

In this case, I believe Alpha certificate refers to certificates issued by AlphaSSL certificate authority which is a brand of cheaper certificates owned by GlobalSign. It's basically a certificate with alternative trust chain, as AlphaSSL certificates are ultimately rooted to GlobalSign Root certificate.

Improve this answer
2
  • Is there any difference between using an AlphaSSL cert or a GlobalSign cert a) from the end user perspective, b) from the site owner perspective? Why would I choose to pay more if they're both DV certs?
    – just.another.programmer
    Commented Feb 26, 2017 at 5:36
  • @just.another.programmer: this is a new question and should not be asked in the comment of an existing question.
    – Steffen Ullrich
    Commented Feb 26, 2017 at 6:07
0

It says there that the offer Requires cPanel. So I'd hazard a guess that the cert is a billable option inside their web host control panel when you've also bought your domain name from them.

Then the verification mechanism would be "being able to log into the web host control panel that's associated with the domain name". And as far as security is concerned I'd say that's at least as good DV's verification mechanism of "being able to receive mail for admin@hostname".

Improve this answer
2
  • Being able to log in to cpanel only proves I control the hosting - not the domain. If cpanel access was valid verification of domain ownership, I could setup a hosting account for a well known website without having control over the domain (DNS) and get a cert for that domain anyways!
    – just.another.programmer
    Commented Feb 26, 2017 at 5:59
  • @just.another.programmer: clarification added.
    – StackzOfZtuff
    Commented Feb 26, 2017 at 15:08
0

AlphaSSL is operated and owned by GlobalSign which gives low-price standard SSL products. However, they exclude all GlobalSign's premier features. AlphaSSL provides chained root certificates, which means they offer more security than single root certificates. It is essential that an intermediate certificate is installed that will help to complete a "Chain of Trust".

Basically, it is domain validation (DV) certificate. AplhaSSL has developed automated domain validation mechanism to confirm your domain ownership and authentication.

Improve this answer
0

AlphaSSL certificates are domain validated.

From https://www.alphassl.com/ssl-certificates/cheap-ssl-certificates.html

Our Certificate application process is fully automated. That means you just need to create a CSR and complete the online application form and then we'll send an automated challenge email to an email address associated with your domain. In about 3 minutes, you'll get your trusted SSL Certificate. No paperwork, no faxes, no phone calls needed. You can order around the clock, 365 days a year - never miss your project deadline because of SSL again.

The email challenge is verifying domain control.

In the case of the GlobalSign OneClick Alpha; that's an AlphaSSL certificate issued via their OneClickSSL plugin for cPanel: https://www.globalsign.com/en-sg/ssl/oneclickssl/

The plugin automates the domain validation process. So, to the end user it may not appear you were ever challenged to prove domain control, but the plugin has taken care of this for you.

Improve this answer
-1

Any ssl certificate, whether it is alphassl or any other, comes with domain validation. And OneClick SSL of Alpha also comes with domain validation.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .