Buying Low Cost SSL Certificates - Browser and OS Compatibility

emg · March 2014

I need a small number of low-cost SSL certificates. The important requirement is compatibility with most browsers and operating systems. I will be using them to secure specialized browser-based applications on my servers.

Here are my questions:

Are there certificate authorities I should avoid, because the certificates that they issue cannot be authenticated by popular browsers and operating systems?
As long as the end-users' browsers establish a secure SSL connection to my servers, why do I care which certificate authority signs my certificate? Do normal end users actually bother to check which CA signs my certificate?

Here are my thoughts:

Buy the least expensive SSL certificate, as long as nearly all browsers and OSs can authenticate it and the corresponding SSL connections are secure (they use appropriate key sizes, etc.).
If a few tin-foil-hat types disable certain root CA certificates in their systems so that my servers won't authenticate, that's their problem, not mine. I suspect that very few people actually do this.

Am I missing any other considerations?

cidero · March 2014

The least expensice SSL certificate would be free: startssl.com

The SSL certificate is compatible with basically everything since about 5-7 years:

Mozilla Firefox 2.0+
Opera 9.5+
Internet Explorer/Google Chrome/Apple Safari depend on the System SSL store, so Windows XP+ and MacOS X+.
Apple iOS 2.0+
Google Android 2.2+

Some websites will tell you that Windows XP needs a service pack or special update, but I tried it for myself, a virgin old Windows XP installed without any servicepacks or updates shows my StartSSL secured websites without any issues in the mighty IE6

I am not sure about Java, Windows Phone and RIM/Blackberry though.

bookstack · March 2014

I think they are referring SNI.

cidero · March 2014

why do you think this is about SNI? SNI is just used to serve multiple certificates on one IP. No matter from which certificate authority. SNI is not working with Internet Explorer on Windows XP, so in my opinion it is still not usable for serious projects.

GIANT_CRAB · March 2014

cidero said: SNI is not working with Internet Explorer on Windows XP, so in my opinion it is still not usable for serious projects.

lol, you're joking, right?

Silvenga · March 2014

cidero said: SNI is not working with Internet Explorer on Windows XP, so in my opinion it is still not usable for serious projects.

IE6 is 12 years old. As of 2014 IE, all versions, have 10% market share - IE6 with a mere 0.1%. Windows XP will be officially disbanded by Microsoft on April 8, 2014. Why are you using either. In my opinion using these outdated systems is unusable for serious projects.

seaeagle · March 2014

@Silvenga said:
IE6 is 12 years old. As of 2014 IE, all versions, have 10% market share - IE6 with a mere 0.1%. Windows XP will be officially disbanded by Microsoft on April 8, 2014. Why are you using either. In my opinion using these outdated systems is unusable for serious projects.

bizarre comment - i cant find any data in last 3 months that shows IE with less than 50%+ market share...

emg · March 2014

Thank you to everyone for their input.

To repeat myself, I just want to make sure that whichever browser the end user is using can authenticate my website. Even though XP is old, I assume that Microsoft has periodically updated the root certificate authorities in the past (through next month). I am willing to accept the possibility that there may be users who never bother to update and thus won't be able to authenticate until they do. I also assume that Microsoft will continue to make the old XP "updates" available for the foreseeable future, even if they do not release new ones after April.

The user base for my particular set of applications has strong domain knowledge for the applications, but many of them may not be very tech-savvy. Even so, it is reasonable to expect that they update their systems enough so that their browsers can authenticate the websites/applications.