They work exactly the same from a technical standpoint! Amazed me too!
Security certificates.... what I knew:
1. Created using public/private keypairs (like PGP) between you and a "Trusted Root Certification Authority".
2. Applied to an IP address and bound to the domain name via the public key you send them which is encoded in the cert they send you.
3. The "Trusted Root Certification Authority" information is also included in the cert you receive from them.
3. Function, to encrypt communications to and from the client browser including server validation (session can not be hijacked because the certificate insures you are still talking to the same server).
What I didn't know until recently:
I thought there were a few (3-5) Trusted Root Certification Authorities. Turns out there are several. What makes an entity a "Trusted Root Certification Authority"? Paying $ to Microsoft and/or Netscape to have their Trusted Root Certification Authority information included in the shipped browser. This is what keeps the certificate warning box from displaying when accessing a SSL page that has a cert from one of these entities. I was surprised how many entities I have selected to "implicitly trust". If you're using IE, go to Tools->Internet Options...->Content (tab) ->Certificates (button)->Trusted Root Certification Authority (tab). Wow! We sure do trust a lot of people by default, don't we?
So... a certificate issued by any of these entities will insure secure communications and prevent the warning from coming up. For that matter, if you had a captive audience for your site, i.e. you're an insurance company with a national sales force of agents who need secure access to a non-public area of your site, you could generate your own certificate and instruct the agents to add your cert to the Trusted Root Certification Authorities on their browser when the certificate warning came up. They would then have the exact same protection and not receive any further certificate warnings! Slick huh? You just saved your company $350-$700, not bad for a few minutes work.
Now the non-technical differences.
For the most part, it is how the issuing authority verifies you are who you say you are that differs. Verisign, who I used in the past, had us fax them our articles of incorporation along with signatures of company officers, etc. This is so they have a degree of certainty that we are who we say we are and that we have the right to do business on our domain. In return for our $350 per year (40-bit key), this is what we get along with a “Verisign seal” to post on our website that links back to their server with some information that our certificate is valid and issued to us. All well and good so long as someone actually clicks on it! Out of 20,000+ visitors to one site I manage, we’ve had three clicks on the seal (and I think two of those were me testing it!
). Does the Verisign seal give our customers a "warm and fuzzy feeling"? Maybe. But my thoughts are that most people don’t even notice it. They may think it’s just another ad-link. In any case, if the "seal" is deemed important, one can be had from Geotrust for $150 (I think). Does the same exact thing. And they do more company verification (similar to Verisign) than with the $25 one which does not include any seal and little company verification. The process of getting the $25 cert is, apply online, pay with CC, answer a couple questions via an automated phone call from them, wait for an email (only sent to specific addresses within the domain or to contacts in the DNS record), click on a link in the email to authorize the cert. The cert is then emailed to the administrative contact and can be applied at will. This, along with a obvious Security Policy explaining the use of SSL, is the route I chose.
I guess the point I’m trying to make is that I don’t think the typical user understands the whole process enough to make purchase decisions based on the type of cert used. I have yet to hear anyone say "If there isn’t a Verisign seal on the page, I’m not going to enter my CC# or personal information." I do agree that sensitive information should be protected within a SSL session, but from the technical standpoint, a self-issued cert would be more than sufficient. The problem is the cert warning box which states that, while the cert is valid, it is not issued from a trusted source. (Only because we didn’t pay M$ and NC tons of money to have our certificate included in the browsers). So I choose to eliminate the real problem the most cost effective way possible, pay $25 to rackshack.net to get rid of the warning and educate the customers the best I can. I’ve always been of the mind that you build trust by successful transactions and giving the customer more than they expect, rather than by paying money to someone to vouch for you.
After all, Verisign doesn't concern themselves with customer complaints of poor business practices regarding a company they have "verified" or threaten to revoke their certificate. At least not as long as they are getting their annual booty.
To see one of the $25 certs in action go to: (email me privately at kgoods@aia%insur1ance%.com) (remove the %’s and 1) if you want the link.
Double-click on the padlock in the lower right bottom of your browser. (This is a new site and is not live yet, I just started on it last Monday but it’s pretty much there.)
You will notice that the only intention of this cert is to Guarantee the identity of the remote computer. The $150 Geotrust cert and Verisign’s certs, have more information stating the company who the cert is issued to. But that information is available if you click on the details tab and select the subject. In the lower box you see the business registration link. If you copy and paste that into the browser it goes to checkpoint and shows the business that the cert is issued to. I know that most users will not know how to do this and I believe that the cert issuers like it that way. They get to charge more to put this information on the first tab! If I, on the other hand, had any doubt whether a company was legit, I would check the contact page vs. Thomas’s online register or the online phone directories before supplying CC information.
Sorry this is so long but this is my soapbox for the week because I really have a problem with the profit ratio some companies are making off secure certificates.
Hope that helps,
Regards,
Ken
