Which SSL certificate company should I go for?

[Dan_ATR]

Hi everyone,

 

So I have looked into getting an SSL certificate for our terminal RDP server and I am some what unsure as to which certificate from who to buy as the pricing is so drasticly diffrent. I have phoned the companys and they all say that they are all the same as eachother, yet I am just really unsure. Please advise.

 

https://www.123-reg.co.uk = 123-SSL @ £86.38 Triennially

https://www.godaddy.com = Standard SSL @ £140 Triennially

https://www.vidahost.com = Essential SSL @ £140 Triennially

https://www.thesslstore.co.uk = RapidSSL Certificate @ £31.18 Triennially

Edited November 7, 2016 by Dan_ATR

[CAWJames]

I use StartSSL, they run it opposite to most SSL cert companies. You basically pay once to get your organisation and yourself validated, lots of hoops, the price reflects what level of certs you want. I paid around £150 for Class 4(proper big org name in green in the address bar).

 

Once you are validated, you can issue as many certs as you want for the validation period I've been using them for a few years no, and never had a problem.

 

Thanks

 

James

[FN-GM]

So I have looked into getting an SSL sertificate for our terminal RDP server

 

Are you aware you will need a SAN certificate for things like SSO to function correctly?

[Dan_ATR]

Are you aware you will need a SAN certificate for things like SSO to function correctly?

 

Im not using SSO, as people will be logging in via a web browser from home, over their personal laptop/desktop, using their wonderfull typing skills and memory loss.

[CAWJames]

I will add for StartSSL, you can issue single SSL, SAN SSL or even wildcards, as many as you want for the domains you have validated. There is a small cost to have a cert revoked if you muck up but its pounds.

[Oaktech]

I've got GoDaddy wildcards certs, multiple services.

[Dan_ATR]

With StartSSL, with the charge, is this annually or a one off cost for years? (look at image)

 

 

Also, I only really need two certificates at the max.

Edited November 7, 2016 by Dan_ATR

[lmrogers]

I too use a wildcard certificate from GoDaddy. They seemed to be reasonably priced.

[Oaktech]

With StartSSL, with the charge, is this annually or a one off cost for years? (look at image)

 

[ATTACH=CONFIG]39607[/ATTACH]

 

Also, I only really need two certificates at the max.

 

I read it as a one-off charge that covers you for 2 years or 3 or whatever, when your time is up you pay again.

[Dan_ATR]

Ok, ill try the free one for jokes then and see what happens. I need to only get what I need as this has not been budgeted for what so ever. Anything else for the same cost will be better. If I was doing this for my personal site, I would go for the full 22p banana but on this occation I am only going for the mashed up milkshake for 5p lol.

[Boredguy]

We normally get ours from JANet via the SWGfL. Think it was about £50 for a 3 yr SSL certificate last time we ordered one, so depending who your ISP is thats another option, but the free 30 days ones is often a good starting point for the initial testing/setup

[CAWJames]

The cost is a one-off for a year, or whatever is stated. Although the certs are proper 3 year ones and won't expire after the validation period. For 2, it may not be cost effective, but we have multiple sites and this saves us a fortune!

 

Free Class-1 certs work fine for websites as well, basic protection, but should be enough, unless you are doing transactions or other stuff like that!

[Arthur]

Going with StartSSL might be a waste of money with Google planning to stop trusting all certificates issued by StartCom in a future update to Chrome.

[Dan_ATR]

I am using Lightspeed with Brourdband4 which I would love to leave and go back to RM. There filtering is absolutly rubish. Now RM have better pricing and AD group funcionality, when our contract ends, I will be going back to RM.

[CAWJames]

Oh buttocks and I've just renewed!!! Please disregard my recommendation then, sorry about that.

[Dan_ATR]

So going by the tope 4 I have listed.... the diffrence is...????

[Oaktech]

I am using Lightspeed with Brourdband4 which I would love to leave and go back to RM. There filtering is absolutly rubish. Now RM have better pricing and AD group funcionality, when our contract ends, I will be going back to RM.

 

@Dan_ATR call my mobile mate, switchboard are being dense.

[BFCIT]

We use Trustico https://www.trustico.co.uk/ - decent folk, always assisted and helped when I've had issues installing SSLs in the past - they have an online chat facility too which is good for troubleshooting/assistance and price queries.

[pete]

We used Namecheap (Multi-domain Positive SSL) for our RDP Gateway.

 

£24/yr with 3 names included. Extra names we're ~£10 each. It's using Comodo as the cert issuer.

[Stuajnht]

Just putting it out there, but have you looked at Let's Encrypt: https://letsencrypt.org/

 

They offer SSL certificates for free, and the process is automated. Have them on our IIS servers, but not sure of the process for RDP ones.

[pete]

Just putting it out there, but have you looked at Let's Encrypt: https://letsencrypt.org/

 

They offer SSL certificates for free, and the process is automated. Have them on our IIS servers, but not sure of the process for RDP ones.

 

What did you use to automate the renewal for IIS? We have Let's Encrypt on the Linux boxes, but the solutions I found for Windows (admittedly a while ago) looked a bit ropey.

[Opendium_Steve]

Steer clear of StartSSL and WoSign - Mozilla have already struck both of them off, Apple has struck off WoSign and Google are planning on pulling the plug on them too.

 

(Frankly, if StartSSL are still even selling certificates without telling you they won't work that's pretty criminal)

 

https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/

 

We've now started to recommend LetsEncrypt for free certificates. Only downside being that you need to run a client on your systems, which is a bit more effort.

[Stuajnht]

What did you use to automate the renewal for IIS? We have Let's Encrypt on the Linux boxes, but the solutions I found for Windows (admittedly a while ago) looked a bit ropey.

Hi @pete,

 

We use letsencrypt-win-simple (https://github.com/Lone-Coder/letsencrypt-win-simple).

 

The scheduled task doesn't always renew, but setting a repeating event in my calendar every two months makes sure I don't forget to check. While it's meant to be automated, a quick 5 minute job to manually check and renew is all that may be needed (Exchange is the worst one, so I run the client again to get it to work: https://github.com/Lone-Coder/letsencrypt-win-simple/wiki/Create-a-SAN-certificate-for-Exchange-2016#running-the-client).

[Dan_ATR]

Iv gone for GoDaddy basic SSL certificate for 3 years.