Has anyone heard of any cases where SSL Certificate insurance - sometimes called "warranty" or "liability protection" has actually been paid out? Or is that just a marketing scam?

Godaddy (under "All certificates include"):

Up to USD 1 million liability protection

ssls.com (last blue square):

Q: What does warranty mean?

A: If data transmitted via a secure connection is stolen, Comodo will pay a lump warranty sum to the victim of such fraud. But really, cracking a 128- or 256-bit cert is absolutely impossible.

  • 1
    I'm new to using this site - not sure how the yellow Q/A thing got up there (if AI, that's impressive) but it does not answer the question. I'm thinking it would even be hard to prove that it was an issue with the cert, or that it was cracked without attaining the PK. Therefore I think the bar is so unrealistic that the claim of insurance is itself really a scam. Likely never paid out - ever. – DP07 Feb 8 '18 at 22:19
  • Question as it stands is off-topic as noted in discussion below. It would be more on-topic if you focused on the more technical aspects of whether data via a secure connection can be stolen (paraphrased from Q/A above), but even that is pretty broad.. see security.stackexchange.com/questions/53596/how-safe-is-ssl. Your question does not relate to information security, but more on legal questions such as how do you prove that it was stolen, and do you know anyone who has claimed such a warranty. – HTLee Feb 9 '18 at 3:35
  • Related blog post: Scott Helme, 2018-02-28, Do SSL warranties protect you? As much as rocks keep tigers away... (Archived here.) – StackzOfZtuff Mar 2 '18 at 11:45

The problem with your question is that such a pay out would require that there be a fundamental flaw in the implementation and that the paid warranty would not be under a strict NDA. If it has paid out, no one would know. And, it is unlikely to ever need paying out (given the nature of TLS certificates).

But I'm concerned about your either/or about this being a "scam". It's an easy "bonus" for the vendor to add because the risk is low of ever needing to pay out. That does not mean that it is a scam. If someone could prove harm, and the vendor did not pay out, then there would be press about that fact. I could offer you protection, free of charge, against dragon attacks, and that does not make it a scam.

  • 3
    I think you owe some folks a payout then: en.wikipedia.org/wiki/Komodo_dragon#Danger_to_humans – Mike Ounsworth Feb 8 '18 at 22:44
  • So you are claiming that selling protection from dragon attacks is something the FTC would not have a problem with? – DP07 Feb 8 '18 at 22:45
  • 1
    @DP07 1) where is it being sold? 2) Why does the FTC come into it? 3) Why would they have a problem? – schroeder Feb 8 '18 at 22:47
  • If you know it would never need to be paid out, or that nobody can ever know it was paid out, then I fail to see how this is not a form of extortion - because a $1 million protection IMPLIES there are REAL alternative scenarios where you can be forced to pay $1 million - though you know it's really not true. – DP07 Feb 8 '18 at 22:49
  • 2
    @DP07 none of this is a security question but a question about the fundamentals of insurance. I have worked for an insurance company, but this is not the place to sort this out. There is nothing wrong with the bonus protection. You also have a flawed understanding about the nature and requirements of "extortion". – schroeder Feb 8 '18 at 22:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.