1

I am making a web site which can be considered similar to Reddit in some ways. I need to implement a sign up form so I will store informations about the users. My idea is to store the username, password, email address, and if they want also the gender, birthday and country. There are many SSL certificates, from free to expensive ones, in my case what are the characteristics that my certificate must have?

I am not looking to spend a lot of money and if it makes any difference in the cost of the certificate I could store only the username, password and email address.

Could a free StartSSL certificate be enough? Or what about a RapidSSL certificate 49$?

5
  • You have to learn a lot before 'storing passwords'. Which means your attempt to build a secure site will be a great risk to you and your users unless you expend some effort to learn about security. Please start with OWASP: owasp.org. Dec 5, 2014 at 16:50
  • they will be hashed Dec 5, 2014 at 16:50
  • This is better, although it wasn't evident from the post. Hashed and salted, you surely meant, right? Dec 5, 2014 at 16:50
  • Yes, I will do that to all the personal data stored Dec 5, 2014 at 16:53
  • Hashed and salted with a unique salt per user with a multi-pass hash algorithm (such as bcrypt), right? As for a cert, the cheapest one that is signed by a CA that your target market already trusts is pretty good. Fancier things can come later when you have more capital and want to decide if having the green URL bar (or what ever) is worth the expense. Probably also look for a CA that isn't likely to be inflitrated, but that can be hard to predict. Dec 5, 2014 at 18:48

2 Answers 2

0

I am making a web site which can be considered similar to Reddit in some ways. I need to implement a sign up form so I will store informations about the users. My idea is to store the username, password, email address, and if they want also the gender, birthday and country.

The type of data being transferred has little to no bearing in regards to SSL certificate choice. This is the reason you are seeing lots of pointers/advice/tips on securing the rest of your architecture. ;)

There are many SSL certificates, from free to expensive ones, in my case what are the characteristics that my certificate must have?

It is recommended to utilize 128-bit encryption or higher (follow any applicable laws in regards to cipher strength) Preferably signed by a 2048 bit Root.

I am not looking to spend a lot of money and if it makes any difference in the cost of the certificate I could store only the username, password and email address.

Again, the information being transferred has little to no bearing. Utilizing an SSL certificate will encrypt the data during transfer but it will not be encrypted at rest.

In all honesty, the choice of CA really comes down to 3 factors:

  • Trust
  • Reputation
  • Cost
0

To have a secure service, you must:

  1. Ensure that the data from your Client -> your Server is encrypted, that's where you need the SSL/TLS certificate

  2. Ensure that the security-related data (e.g. password) on your server is stored in encrypted / hashed+salted form.

A certificate from StartSSL is as secure as a certificate from other CAs, if your client's browser does trust the CA. The CA does not know the certificate's private key.

Not the answer you're looking for? Browse other questions tagged or ask your own question.