Today I had to purchase a SSL(Secure Socket Layer) certificate to complement an online booking system I developed for a travel/tourism company. Now I’ve had very limited experience with SSL certificates and when time came to actually buy one I didn’t know where to start.
Due to the large price difference in SSL certs from CAs(certificate authorities) such as GeoTrust, Verisign, Thawte and co., I assumed that there would be significant differences in the certificates themselves. I figured encryption algorithms, encryption bit size(128, 256, 512..) would differ but not sure what else.
Turns out there’s a few things such as:
- how many browsers have the CA’s root certificate installed
- whether mobile browsing devices have the root cert. installed
- EV(Extended Validation) where the SSL provider validates against more then just a domain name
- customer service & support
This is by no means and exhaustive list but it’s a start. A good discussion on the topic can be found at Slashdot: Choosing an SSL provider?
In the end though, I discovered that there are quite a few minor differences but overall they’re all pretty similar or at least not dissimilar enough to explain some of the very large price differences. One of the main criteria was that it work on as many browsers as possible, so in this case, choosing a big well known name seemed like the right way to go. I eventually chose GeoTrust True Business ID with EV because it seemed to tick all the boxes and it was on sale!