8

When looking to get an SSL certificate one is presented with a lot of options. For example lets take Network Solutions since they have a nice comparison chart.

Immediately there seems to be 4 major options: Cheap certificates, business class certificates (which have the same features as cheap certificates but with support and a bigger grantee), wildcard certificates, and Extended Validation certificates.

Does it really matter in the end which certificate you get? How many people besides paranoid security people check the encryption strength and the level of verification of every HTTPS site before going further in?

Why would sites go for Extended Validation when a cheap certificate or Business certificate will do just fine? Extended validation in this case is 4x as expensive than the Business certificates, and 30x as expensive as a cheap certificate. Is it purely for the tech support and larger grantee's or is there another reason?

Improve this question
2
  • 1
    Matter for what? To prevent an attacker for spoofing your certificate? For users going to the site? If its the users you need to describe either what the site is or who the users are.
    – this.josh
    Aug 30, 2011 at 22:32
  • 1
    None of the options listed in your question relate to the "Encryption Strength" of your website. They all relate how much work Network Solutions does to validate the "Real World" Identity of the person/company running the website. I'd suggest that this question could be made better if the title was reworded to ask about SSL certificate validation levels and not encryption strength.
    – Walter
    Jan 2, 2015 at 23:42

3 Answers 3

Reset to default
6

The important part in the page you point to is the "guarantee": how much money NetworkSolutions puts at stake. The options all boil down, more or less directly, to that.

Cryptographically speaking, the "encryption strength" will depend on the type and size of your public key (the one you will put in the certificate) and the cipher suites you configure on your SSL server; this is mostly orthogonal to the certificate "category". NetworkSolutions might enforce some requirements on the public key (e.g. requiring a 2048-bit RSA key for the more expensive certificate types); but SSL server configuration is completely out of their reach.

Improve this answer
1
  • This is a good answer, if the chain has a trust up through to a root CA then you have about all you can ask for from a technical perspective. Besides how easy the company is to interact with and how responsible they are in handling you as a person. From a business perspective, you want to be able for that business to take the heat (indemnify) you in case of compromise with their cert.
    – M15K
    Aug 30, 2011 at 18:35
5

Virtually no end-users check the issuer, and even if they did, verrrrry few people could make an informed decision about the relative quality of the CA's.

My experience and opinion are that EV-SSL are of low value. Depending on a user to recognize the difference between a blue bar and a green bar is a tall order. And in any case, if a bad guy were to get a rogue cert, it won't matter to your users if the real cert is EV. I'm sure there are others with the opposite opinion here, but take this one for what it's worth.

Improve this answer
1
  • It doesn't matter to the users, indeed. It does matter to the businesses - "for how much can we sue the CA if excrement hits the ventilator?".
    – Piskvor left the building
    Sep 22, 2011 at 11:06
-1

How many people besides paranoid security people check the encryption strength

Only badly informed people would check the encryption strength.

Nobody attacks SSL/TLS encryption itself! Cyphers are strong enough - except the 40 bits "US export" castrated crap of course.

For example: In case of Transport Layer Security (TLS) Renegotiation problem described in https://www.ietf.org/rfc/rfc5746.txt : the vulnerability was inside the a rarely used feature of the protocol, not a problem with the crypto itself.

Big bit numbers are ONLY there to impress people who do NOT understand computer security. It makes absolutely no difference in practice.

EV solves a problem that does NOT exist, and does nothing to solve the MANY problems that do exist with this SSL PKI: EV is a PR stunt. If EV was to be taken seriously for WWW security, we would have a new "httpsEV:" URL scheme.

Informed users who worry about attacks against the SSL layer do NOT care about EV.

Informed "paranoid" users DO worry about unexpected certificate change especially if you change CA. Inform users in advance if you change CA.

Informed "paranoid" users DO worry about CA that have done bad things in the past, so expect some users to reject or at least question you about COMODO certificates.

Improve this answer
6
  • 2
    Do you have solid quantitative evidence that EV is not effective and does nothing? As I understand it, at this point it is a matter of opinion and debate, rather than a 100% settled question.
    – D.W.
    Sep 22, 2011 at 8:08
  • 2
    "Nobody attacks SSL/TLS encryption itself!" [citation-needed] Is it ironic that you posted this a day after a known-plaintext attack against TLS 1.0 was demonstrated? ( User-friendly summary e.g. here: theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl )
    – Piskvor left the building
    Sep 22, 2011 at 11:10
  • "evidence that EV is not effective and does nothing?" : as I said : If EV was to be taken seriously for WWW security, we would have a new "httpsEV:" URL scheme.
    – corrector
    Sep 22, 2011 at 12:50
  • @ Piskvor It is VERY ironic indeed. I heard about "BEAST" a few hours after I wrote this. But, I never comment on announced vulnerabilities before I get the details.
    – corrector
    Sep 22, 2011 at 12:55
  • "Informed users who worry about attacks against the SSL layer do NOT care about EV." -> it means that badly informed users WILL fall for the "high security" EV nonsense.
    – corrector
    Sep 23, 2011 at 0:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .