Risk in buying an SSL cert from a not well-known party

Question

Let's say I know a guy is selling an SSL cert at a very low price, assume they will generate a real and valid cert for me, since I need to submit my CSR to them and they pass to the CA, are there any risks involved in buying cert from them technically?

Second question is: given a cert, are there any methods I can know from whom the cert was bought? (Besides asking the CA)

Update: I mean the reseller is selling well-known SSL (Comodo Positive SSL) at a very cheap price, e.g. 10-20% than reseller such as namecheap, but I need to submit CSR and buy from them instead of Comodo, so I need to know the risk.

Answer 1

There is no risk of compromising the private key, because you send only the CSR which contains the public, but not the private key. But using a CA is in effect a trust delegation, as people trust your certificate because they (or the browser) trust the CA that signed the certificate. Once they notice that the CA is no longer trustworthy (like DigiNotar after it got hacked in 2011) they will remove the trust and thus they will also not trust any certificate issued by the CA any longer - which directly affects you.

If the CA itself is trusted but the reseller is just cheap, I would not worry too much. Reseller often get a huge rebate from the CA and can thus offer cheap prices if their other costs (like marketing) are small.

You should better check if the seller has high costs for services you don't need right now, but might need later - like certificate renewal or revocation. This is so called buy-in, and you must be on the lookout for this tactic almost everywhere you shop.

Answer 2

The risk of using a shifty-looking CA is not in the certificate enrollment process: as long as you generate the key pair yourself and send only the certificate request to the CA (which contains only the public key) and receive the raw certificate in return (not a PKCS#12/PFX archive), then your private key is yours and yours only.

The risk, though, is in trusting. For your certificate to be useful, whoever you show it to (e.g. client Web browser) will have to trust the CA -- otherwise, your certificate would do you no good at all. If they trust the CA, then they trust whatever certificates that CA may produce. Technically that is not your problem, but the clients' problem; however, if the CA looks really cheap then, by association, you will also look really cheap. This might not be the image that you want to project.

A client can easily know the provenance of any certificate by asking his browser to display the "certificate chain" (just click on the "padlock icon").

Answer 3

Things to know about resellers.

1. It is a fairly common practice for CAs to sell their lower cost certificates through resellers at cheap prices, but sell the same ones at much higher prices on their own website. This fact in itself is not a cause for concern.

   When they make a sale through a reseller, the cost to them is reduced. Plus, they depend on their reseller network for promoting their product.

2. Resellers handle billing and aspects of support, but they do not have access to the CA's root private keys and cannot generate certificates on their own machines. The certificates are still generated on the CA's machines, according to their own procedures for security and information handling, and must still satisfy their requirements for proving identity, etc. In fact, the reseller doesn't really have much control over any aspects of security and hands this all over to the CA.

   So, the quality and security of the end product you receive will be the same as if you bought directly from the CA.

Things to be aware of when buying from an unknown company

1. Do they provide decent customer support? The CA whose product they are reselling probably won't provide support to you directly; that's handled in most cases by the reseller.

2. If you need to revoke a certificate, do they charge for that service? Is it a high cost?

   Cost of renewal is not so much an issue in most cases because you are free to just renew with someone else if you want to. There is no system preventing you getting a cert for the same domain from a different provider.