6

Has anyone heard of any cases where SSL Certificate insurance - sometimes called "warranty" or "liability protection" has actually been paid out? Or is that just a marketing scam?

Godaddy (archived link) (under "All certificates include"):

Up to USD 1 million liability protection

ssls.com (last blue square):

Q: What does warranty mean?

A: If data transmitted via a secure connection is stolen, Comodo will pay a lump warranty sum to the victim of such fraud. But really, cracking a 128- or 256-bit cert is absolutely impossible.

2

2 Answers 2

6

The problem with your question is that such a pay out would require that there be a fundamental flaw in the implementation of TLS and that the paid warranty would be under a strict NDA. If it has been paid out, no one would know. And, it is unlikely to ever need paying out (given the nature of TLS certificates).

But I'm concerned about your concerns either/or this being a "scam". It's an easy "bonus" for the vendor to add because the risk is low of ever needing to pay out. That does not mean that it is a scam. If someone could prove harm, and the vendor did not pay out, then there would be press about that fact. I could offer you protection, free of charge, against dragon attacks, and that does not make it a scam.

9
  • 4
    I think you owe some folks a payout then: en.wikipedia.org/wiki/Komodo_dragon#Danger_to_humans Commented Feb 8, 2018 at 22:44
  • 1
    So you are claiming that selling protection from dragon attacks is something the FTC would not have a problem with?
    – DP07
    Commented Feb 8, 2018 at 22:45
  • 1
    @DP07 1) where is it being sold? 2) Why does the FTC come into it? 3) Why would they have a problem?
    – schroeder
    Commented Feb 8, 2018 at 22:47
  • If you know it would never need to be paid out, or that nobody can ever know it was paid out, then I fail to see how this is not a form of extortion - because a $1 million protection IMPLIES there are REAL alternative scenarios where you can be forced to pay $1 million - though you know it's really not true.
    – DP07
    Commented Feb 8, 2018 at 22:49
  • 2
    @DP07 none of this is a security question but a question about the fundamentals of insurance. I have worked for an insurance company, but this is not the place to sort this out. There is nothing wrong with the bonus protection. You also have a flawed understanding about the nature and requirements of "extortion".
    – schroeder
    Commented Feb 8, 2018 at 22:51
1

I realise this is a six year old question. But I think it's worth having some up-to-date information. Today I did a deep dive into the topic of SSL liability protection (L.P.), after someone tried to tell me it's better to use a paid SSL certificate (such as those from GoDaddy), because the free certs (like Let's Encrypt) don't provide L.P.

As of today (2024/05/07), from a Google search on the entire GoDaddy site, I see no mentioned of their liability protection any more. There's no mention of it on the SSL certificates sales page, which the OP refers to in their post. The only relevant place it shows up on their site is an article they published in 2019 promotion the idea it's better to get a paid SSL cert because it provides liability protection: Paid and free SSL certificates? What you need to know

I will also mention, that article appears to have been widely copied across the Internet, and appears to be the primary source of this idea or advice that one should get a paid SSL for L.P.

In reality, as I understand it, the likelihood of someone successfully cracking a modern SSL certificate with strong encryption (such as 256-bit) is extremely low. These encryption methods are designed to be highly secure, and cracking them would require an immense amount of computational power and time, often exceeding the capabilities of even the most determined attackers.

Of course, there can still be vulnerabilities in the implementation or configuration of SSL/TLS protocols, or in the systems that manage the certificates. For example, there have been instances where vulnerabilities in SSL implementations (such as Heartbleed) have been exploited to extract sensitive information.

So, in the case of Let's Encrypt, which is what I've used on hundreds of domains over the past 10 years, their certificates use industry-standard encryption, and any vulnerabilities would typically be addressed promptly by the organization. So, while no system is entirely immune to breaches, the likelihood of a data breach specifically due to a flaw in the SSL certificate itself is indeed very low, especially with properly implemented and maintained SSL/TLS protocols.

In light of this, in my professional opinion the need for liability protection specifically for SSL certificate failures can safely be seen as more of a marketing strategy (gimmick/sham/ploy) rather than a practical necessity. Calling it a "scam," as the OP did, is perhaps a bit harsh as it implies malicious dishonesty. As opposed to GoDaddy just avoiding telling the whole truth. The reality is they were offing the L.P. of $1M (although no longer do so), BUT it was unlikely to ever be needed by a website owner.

Hopefully this answer clears the matter up, as it stands in 2024.

3
  • "Scam" is not just harsh. It's inaccurate. If I sold you a teacup, and said, "if you buy this teacup from me, if it ever gets eaten by a dragon, I'll replace it for free" that's not a scam. Nor is it a "sham". Remember that this LP was not an extra charge or sold separately. It was part of the agreement. Which is why the original question is off-base.
    – schroeder
    Commented May 7 at 9:05
  • 1
    It's probably not a scam in any legal sense. But questioning whether this “warranty” ever actually becomes effective is perfectly legitimate. As inspirednz points out, some CAs justify their certificate prices (which can be hundreds of dollars) specifically with the “warranty”. If that “warranty” turns out to be the equivalent of protection against dragon attacks, it's valid to criticize this. No, there's no extra charge. But the “warranty” may be the reason why people are willing to pay hundreds of dollars for a certificate in the first place.
    – Ja1024
    Commented May 7 at 9:59
  • 1
    If a website (and potentially the corporate infrastructure sitting behind it) is going to be compromised it's not going to be because of SSL. It's going to be caused by a flaw such as SQL injection. SSL does not mean the website is "secure", it just secures the transport layer and the exchange of data between client and server. To some extent, certificates could protect against impersonation (extended validation) but that looks like a scheme to charge even more money because who bothers? The cert issuers somehow need excuses to justify their fees.
    – Kate
    Commented May 7 at 12:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .