Ssl

[hearn]

Does anyone know if there is a way to obtain a certificate to use with OpenSSL for free without having to pay for the fees from companies like verisign?

[gnuix]

You dont NEED to go with verisign, just incase you didnt know that.. im sure you probably did. You can just use the "fake" cert that is generated with your ssl install.

However, it will popup a message when people goto your site saying its not certified.

But else than that, this topic has been discussed and the general answer is no.

So if you are going to do ecommerce and wish to look reputable you will probably have to fork out. If you are just learning or playing around, dont bother buying a cert, you already have one.

Hope that help and wasnt pointing out the obvious.

[bretticus]

Try www.geotrust.com or www.qualityssl.com if you really need pay for that certificate. I dunno about qualityssl.com much except their cert is $25 USD until Dec 31. Geotrust is $139 first year and you can get the certificate literally in 10 minutes if you have an e-mail address like [e-mail].

As for the overall question. It is my understanding that you can use any CA as long as you have a CA server to authenticate your secure site. This is a common practise in intranets so that nodes may not "pretend" to be someone else (the same reason we need this service on the Internet). However, your browser, as shipped, will only trust certain CA's (Verisign, Thawthe, the ones I meantioned, etc.) And therefore, if you want a secure site for consumers, you don't want any confusing messages popping up in their browsers saying the site might not be secure. To the average AOL user, that's worse than no secure page at all :rolleyes:

Good luck!

[hearn]

Thanks to the both of you for all your help. I knew some of this and didn't know some of the other stuff. Do either of you have any recommendations on what a good ssl server is to use within windows? Apache SSL possibly?

Cheers