0

First of all, my first Stack Exchange question! I hope I'm at the right place.

Secondary, I know TLS is the successor of SSL, but since everywhere I go, they just called it SSL, I'm using it for this entry. Unless I'm wrong on that...

Scenario

I need to decide which SSL certifications to get for three websites under a single parent company, but each websites have it's own identity, and one of them does not want to be known to be under the other (for marketing reason).

Question 1

Based on my price research, getting multiple single-domain SSL is actually cheaper than getting one multi-domain SSL? Example is this: https://sslmate.com/pricing (I hope I'm allowed to post link). If I get three single-domain, it's $15.95 times 3. If I get multi-domain with three domains, it's $24.95 times 3.

Question 2

From what I understand, multi-domain SSL allows different domains to be identified as under the same organisation.

If I have no need for this, is there any other advantage of just getting multiple single-domain SSL?

Question 3

If the above assumption is correct, is the "multi-domain SSL allows different domains to be identified as under the same organisation" limited to EV or OV?

Question 4

While I assume there is no difference if we are using Windows server and not Linux, I can't find a Google search result that supports this. All I found from Google is that installing SSL is done differently. Does having Windows server affect the decision to get which SSL cert?

Question 5

(Sorry, the more I type, the more questions pop up in my head...)

Does having SSL affect SMTP/email in any positive way?

  • 1
    Do you need EV certificates? If not, consider Let's Encrypt, they offer free certs trusted by all major browsers. No need to pay greedy corporations for something that can be provided for free in a fully automated way. – André Borie Aug 15 '16 at 2:11
  • You are correct, SSL is the overarching name for the technology, and SSL#.# or TLS#.# are specific implementations. I think you mean "certificates" not "certifications". – Jesse K Aug 15 '16 at 16:27
0

Some background before getting to the answers.

  • Certificate Authority

    The choice of vendor for a company's certificates is an important one. The certificate provider is what's called a Certificate Authority. Purchasing a certificate creates a implicit trust or custodial relationship between the company and the Certificate Authority.

    It is similar to choosing a lawyer. If the company has assets and its brands value, do not choose a CA solely on the basis of price. Research equivalent companies and brands in the relevant sectors and see what CAs they are using (this can be determined by clicking on the lock icon in the browser URL bar).

  • Terminology

    TLS is the slightly more correct way to refer to the more recent improvements to the encryption protocol, but SSL is still colloquially accurate.

Answers:

  1. Only one multi-domain certificate needs to be purchased to service three different domains, not three multi-domain certificates.

    The presence of three domains on the single certificate could be an indication for those who care to look that the three domains may be related. However, few people care to look and any relationship is not obvious to ordinary consumers. If the distinction is branding rather than corporate- 3 brands under one company, rather than 3 separate companies- the single multi-domain certificate does not by itself introduce a conflict.

  2. Convenience and cost. Certificates are purchased and have to be deployed in web servers and/or load balancers, and the unit of cost and unit of deployment is the individual certificate. Purchasing and deploying one certificate that addresses the needs of every brand- for companies with many brands- is significantly cheaper and more convenient than purchasing and deploying individual certificates for each brand.

  3. No, a multidomain certificate does not need to be EV or OV.

  4. No, while the installation process depends on the specific web server or load balancing software- and therefore operating system platform- the certificate- a file generated by the Certificate Authority- is the same.

  5. Having SSL/TLS on a website has no impact on email service. Furthermore, it is possible to use a certificate on a mail server for outgoing and/or for inbound mail, but it does not add appreciably to the security attributes of one's email, nor does it make a significant difference in one's email reputation.

    Email is a different protocol from web- store-and-forward, vs end-to-end- and guarantees offered by a sender's or recipient's certificates do not apply to the full path traversed by email messages, as they do with web requests and responses.

  • Thanks your reply, I got a question regarding your "Only one multi-domain certificate needs to be purchased to service three different domains, not three multi-domain certificates." I was looking at ssls.com/ssl-certificates/comodo-positivessl-multi-domain , thesslstore.com.sg/geotrust/true-businessid-multi-domain.aspx ; all of them seem to indicate each domain is additional cost? – Mr J Wolf Aug 16 '16 at 3:02
  • That service will charge for each domain incorporated into the multi-domain certificate- but what one is acquiring is still a single certificate- one file- that can be employed for all domains, compared to the alternative of having a different certificate (file) for each domain. Does that help? – Jonah Benton Aug 16 '16 at 15:16
  • Correct me if I'm wrong, so... multi-domain cert is the same throughout three domains, the extra cost the ssl stores are quoting is for incorporating it into each domain? Yet that is not counted as part of an installation fee? – Mr J Wolf Aug 17 '16 at 1:10
  • Yes to the first, no to the second. A certificate is just a file- provided by a Certificate Authority- that can be installed on any web server- managed by you or by your hosting company. Some hosting companies, like GoDaddy and Amazon AWS, are also Certificate Authorities, but not all, and most CAs are not hosting companies. Any installation or configuration fee is paid to your sys admin or hosting company. So one file for all domains definitely easier than a file for each domain. – Jonah Benton Aug 20 '16 at 3:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.