blogs.teztech.com

I’ve written other places about SSL certificates. Once upon a time, you bought your SSL certificates from either Verisign or Thawte. Back then, all (both) SSL Certificate Authorities (CAs) did some real validation on the entity (business or person) that was applying for the SSL cert. To validate the entity, they did things like review corporate records to make sure addresses matched, looked up phone numbers in public directories and matched drivers licenses to domain registrations.

I can understand why they wanted a bit of money for the work that was required for validation that first year, but overall, SSL certificates have long been overpriced for the value they provide. After that first validation, the next year’s renewal costs the CA practically nothing, but they used to give no renewal discounts at all and, even now, renewal discounts don’t exist and multi-year discounts are not as substantial as they could (should?) be.

Then there were (are) silly SSL cert upgrades that supposedly provided stronger encryption. Well, I suppose those upgrades actually could enhance encryption if you just happened to be running an old, obscure version of IE that was only available outside the US, only for a short time and has not been available since early 2000. Funny how even today, you’ll find that even the biggest CA charges extra for Server Gated Cryptography, even though no browser modern enough to be secure needs or supports it.

If you want to spend even more on your SSL cert, CAs will happily add on various types of hyper-specific insurance policies and all manner of “site seals” and  “trust logos”.

The entire verification and trust thing is just silly. The percentage of Internet users that would recognize Verisign, Thawte, Comodo or any other CA is vanishingly small. Even if we were to assume your average Internet buyer were a sophisticated, educated, rational consumer, why would they trust some company they’ve never heard of to tell them how trustworthy amazon.com is? On top of all this, given the year after year rape attempts committed by big CAs with their over pricing of renewals, fake SGC upgrades and other kinds of fake “strong cryptography” upgrades, the only thing I personally trust CAs to do is to make as much money as they possibly can with any means at their disposal.

With the useless state of verification and trust, it’s no wonder that some smaller CAs eventually started verifying less and charging a lot less. Now days, you can buy an SSL certificate that certifies nothing other that you are using SSL. Fair enough – even that tidbit is more than most consumers are interested in knowing. Practically speaking, SSL is only a technology for the vendor. Vendors should use SSL properly because they care about the consumer enough to not transmit their personal information in the clear over the Internet.  Frankly, if my wife, my Mom or one of my kids finds something they want to buy, as long as the browser don’t completely refuse to accept the connection, they will be happy to click through all manner of browser warnings to put in a credit card number. Haven’t we all been trained to ignore these peskey warning messages by now? A few shoppers might be consoled by a a happy, friendly padlock icon, but how many users are fully aware that the pad-lock icon is supposed to be in the browser’s status bar. “What’s a status bar”, you ask?

Given all this, I’ve been using the least expensive SSL certs I can find. Here are a couple of different examples – can you tell what kind of validation was used?

• https://www.searchenginecommando.com/order/  (cheap)
• https://www.t3city.com/ (cheaper)
• https://www.embracegroup.com/index2.html  (cheapest)

I suppose the SSL CAs all got together and decided something just had to be done before everybody started using self-signed SSL certificates. Enter now the “Green Address Bar” SSL Certificate. The real name is the “Extended Validation”  SSL Certificate, but my name would be better. At least with my name, there is a slight chance that consumers (of SSL certs) will notice.  If you have one of these super-duper certificates, IE’s address bar is supposed to turn green (as in the color of money, eh?). I think this is a Vista only feature, though.

The SSL vendors want $500 and more for these “EV” SSL certs. Personally, I think they are pricing themselves out of the market. Yes, a handful of sites like amazon.com will pay the extra $489 for the SSL cert that makes the browser’s address bar turn green (as in the color of envy?). I have to guess, though, that the vast majority of SSL certs are purchased for small e-commerce sites like searchenginecommando.com, t3city.com and embracegroup.com. These small operators will rightly assume that public will pay no attention to the fact that the address bar is not green. Personally, I doubt if many people really even look for the SSL lock icon anymore. If EV were just a $50 up-charge, then a lot of small shops might would go ahead and get it (at least for the first year until they find out it didn’t effect sales). Right now, since the new certs are so expensive, practically nobody will buy them and buyers will just forget all about the green address bar. If they do notice, they’ll probably just have a vague notion that something wrong with their computer (again). “Wasn’t Vista supposed to fix these kinds of problems?” they’ll wonder.