Self signed SSL certificates........

[denchomsky]

What do you do about SSL certificates on your ecommerce sites?

Having that Untrusted Site popup when using self signed certificates is really off putting for potential customers, but other than paying someone like verisign to verify your site is trusted, what can you do?

 

[monaghan]

We resell AlphaSSL quite cheap so there's no need to have a self signed one. There's lots of other low end certificates that are compatible with virtually all browsers that can be had quickly & cheaply.

 

[denchomsky]

Yeah looking at one for £16 per year from a company called Xilo, who are in partnership with Global sign, who seem to be big.

I presume verisign and thwarte charge so much for theirs, because they are the most well known, therefore the most trusted.

 

[monaghan]

the "big" companies charge more because they can!

You also need to check the suggested use for each certificate, if you plan to do a lot of big business, then the more expensive certs will have better checking and company validation and therefore cost more to setup and issue, but tend to come with better guarantees.

 

[jimm]

Also worth noting some of the cheaper end SSL certs are in mobile devices so if you want these sites to be viewed on mobiles its worth getting the right cert!

 

[chrisduggan]

My host supplies and installs ours on request for £40 p/year which does the job, nothing fancy but identifies the little padlock icon which customers like.
In the past I have used the 'Green bar' EV SSL on a clients site which cost £1000 for the year that was some time ago. It's worth shopping around once you know what you require. If its for an affiliate site some would argue there is no need for one. A lot of sites will redirect to a third party gateway.

Ive used this in the past which is free for 90 days, also GeoTrust ones that seemed good value for money.

 

[denchomsky]

Its for car trawler integration on a website where I have chosen to have the booking/payment section hosted on my site rather than redirecting to theirs, to allow me to style the application, and make it more customisable.

The actual transaction is done on my site, so the page has to be https, and therfore have a CRT, though I do not handle the processing of the payment.

I was wondering what the potential pitfalls of doing this could be, liability, complaints e.t.c, and whether it would just be easier to use their out of the box iframe solution?

 

[denchomsky]

Ive used this in the past which is free for 90 days

Yeah I saw that , but couldn't find anywhere on their site how much it cost after the 90 day period elapsed?.

 

[fish]

I have chosen to have the booking/payment section hosted on my site rather than redirecting to theirs

If you are taking payment (cc info) then you should not be looking for cheap options. The PCI standard will help you address all matters of security.

I would let others do the ordertaking / payment processing since you then will not be liable for any data loss/breach, secure storage of customer data, security of data whilst in transit etc etc

 

[monaghan]

If you are taking payment (cc info) then you should not be looking for cheap options. The PCI standard will help you address all matters of security.

I would let others do the ordertaking / payment processing since you then will not be liable for any data loss/breach, secure storage of customer data, security of data whilst in transit etc etc

Unless you have a very high turnover, then I'd agree with this, much easier to outsource and take a hit on the fees.