Current Mood:
Meh
Things are progressing on Merchant Site #3. The biz reg has been sent (I should have my official, embossed papers in return mail today or tomorrow), and the ZenCart is ready for me to pull the trigger.
And, that reminded me…I needed an SSL Cert for this baby, and to renew the one for Merch. Site #2.
An SSL Cert, if you don’t already know, is what makes that little lock appear on a secure site. It makes the encryption work. It also serves an identification function, which is one of the reasons browsers put out warnings when things don’t match up.
Now here’s the bit with these things: You can get ‘em for $15, $49, or even–hold onto your seats!–$800 and up!
So, when I opened Merch. Site #1, I educated myself on the difference. For anyone who wants to know, here it is in a nutshell:
The SUPER CHEAP jobbies are “chained” certificates. This is Greek for that it could have gone through several resellers, all vouching for the prior reseller’s reputation. So, all it takes is one weak link in the chain, and you end up with junk. Those are a bit too iffy for me.
The CHEAP ones ($49) are just fine for any sane purpose, as far as I can tell. You get a “root level” cert, that is, one that has NOT gone through a gauntlet of resellers. So, you only have to trust the one company. For $49 it’s got very minimal identity authentication. It has to go with the site you’re trying to run it on and that’s about it. Oh, they claim to authenticate the buyer. LOLOL that consists of a short phone call to the buyer! BUT, the real point of an SSL certif is to get that sensitive data to encrypt, get the lock showing, and basically keep customers from running away screaming–NOT to show that [my real name] is really me, or that I’m on Dun & Bradstreet (which I’m not), or any of that.
So, in short, the $49 one is just fine. And, that’s what I get.
The LUDICROUSLY EXPENSIVE VERISIGN ONES are a ripoff from all I can tell. The only difference between these things and the $49ers, is that they put the buyer through a bunch of hash to prove their identity. The important part–the encryption function–is no different! What Verisign and their ilk do is make the buyer fax in a bunch of paperwork, take about 5 days to *really* verify it, and then fork up the darn cert. Oh, and the merchant gets to display that fancy Secured by Verisign seal instead of the kind of cheap-looking “Secured by RapidSSL” one that I have. Woopee.
But, some people think that they should overspend when they’re a business, and a lot of big companies have that same insanity, so there’s a lot of Verisign seals to be seen out there.
There’s actually a FREE way to get an SSL certif! It’s called a “self-signed” certificate. What that basically means is simple: You can generate your own certificate! Most decent server management software has this capability, although shared-hosting users may be outta luck unless they can get their host to generate one for ‘em. But before you run to get a free one:
With the self-signed ones, there is no ID authentication at all. It’s basically saying, “It’s secure, cuz I said so.” It DOES really enable the same 128-bit encryption that all the others do. But, it makes the browser kick out multiple warnings: “This is an unknown certificate issuing authority” (or words to that effect) being chief among them. And if you don’t use it on the domain it’s made for, it, like all others, will also trigger warnings based on that mismatch.
Due to the warnings, no customer in their right mind is going to trust a self-signed certif, which is what’s wrong with those–and what keeps the “certifying authorities” (SSL cert sellers) in business. But there may be some noncommercial applications for those. Self-signeds are also good as “practice” installations, which comes in handy when figuring out a new installation interface.
As for what one of these certificate files looks like, all the components are made of what appears to be gibberish. Like someone randomly pounded on a keyboard with their fists until they generated about 200 characters of junk!!
Yet, out of that “junk,” browser software can pick out all kinds of stuff–the site it’s issued to, when it expires, who issued it…and whatever info is needed to make the encryption happen.
So the tech is pretty cool, despite the fact that it costs money to get a certificate that browser software actually recognizes.
business merchant site 3 selling the internet