Re: [gentoo-user] OT - SSL certificate authorities

[kashani <kashani-list@badapple.net>]

Antoine wrote:
> Hi,
> We are going to set up ssl on a webserver at work and I guess that means 
> we need a certificate... does anyone have any useful alternatives to 
> Verisign? Are they really worth the name?
> We are not going to be doing any monetary transactions but our clients 
> are very security conscious (who isn't!) and I have no experience in 
> these matters. I am certain the boss will want verisign, as he buys a 
> lot of stuff just for the name but if I can offer him a comparable 
> alternative at a fraction of the cost he may go for it.

	We've got a number of customers that use Geotrust which is 
significantly cheaper than Verisign/Thwate. Someone also uses Starfield 
which is dirt cheap.

	There is a technical issue when using certs no one has ever heard of 
before. Many times their cert company's root certs or whatever are not 
in the user's browser. In order to fix this you'll need install the cert 
company's intermediate cert or chain cert on your server so that the 
broswer can chain your new cert to a cert it already trusts.

SSLCACertificateFile conf/ssl.crt/starfield-chain.crt

kashani
-- 
gentoo-user@gentoo.org mailing list