Are there any requirements in PCI or HIPAA, or other security standards that may impact general government, payment processing, healthcare, that would disqualify any CA vendors that are trusted by the major browsers from being a valid choice for public facing websites? Or that prescribe a list of specific CA vendors that are approved? Are there any known downsides to just going with the cheapest vendor that is browser trusted and can issue certs that meet other requirements like sha2, 2048 etc.


I’ll address HIPAA first, since it is an actual regulation you are required to comply with (assuming you are s covered entity) whereas PCI compliance is a contractual requirement imposed upon merchants by their banks / merchant account providers / gateway processors.

HIPAA does not have any specific technology requirements with respect to SSL certificates. It does require that PHI be encrypted BOTH in transit and at rest, but generally defers to what is considered “best practice” for the technical details, as defined by the National Institute for Standards and Technology.

As a general rule, I would imagine that the firm that does your audit will ensure that you are using modern TLS protocols and a strong enough encryption level for your certificate and also ensure you are properly encrypting the data in whatever storage system you are using. In my experience, these things are less “pass / fail” and more of a scoring continuum.

I’d imagine you’d get a better score on your audit if you use a full EV SSL certificate from a major vendor that does a deep background check on your firm to ensure both the business (identity verification of who you are) and the technical (certificate configured to use modern / strong encryption) instead of using Let’s Encrypt or something to generate a perfectly valid certificate. Neither should result in you “failing” an audit, at lease not in my experiences. I’ve used CloudFlare’s shared SSL/TLS certificates with no problem in the past, though YMMV.

I found this article helpful in understanding the distinction between what’s required and best practices. Also, I tend to use the Qualsys SSL/TLS Online Testing Toolto review client configurations during my own audits, and you might find it helpful.

PCI-DSS Compliance is a little different. They DO specify (and update over time) the requirements on what specific TLS/SSL encryption technologies are required for compliance, though you should generally be able to comply with any of the above I mention earlier.

If you want to gain a higher score on your audit (and potentially lower your Merchant Account transaction fees & cyber insurance premiums, go for the fully paid high-end EV certificates. That’s a business decision more than a technical decision and any of the possibilities discussed above should meet your technical needs assuming you follow best practices.

  • 1
    I'm marking this as the answer since it's pretty much the conclusion I came to anyway and haven't encountered any issues on changing our certificate vendors so far in terms of our audits and compliance scans. – bkr Feb 1 '18 at 23:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.