News for hackers. Stuff that matters.
Re:Google SSL Search by dspillett on Wednesday May 11, 2011 @04:54AM (#2535703)
The free certs from http://www.startssl.com/ are apparently accepted by most browsers these days (the exception being IE6/7 users on XP who have not downloaded the optional CA cert updates): http://en.wikipedia.org/wiki/Startssl#StartSSL

I've not used their cert for anything yet (I plan to test them on some personal sites when I get chance, before using them elsewhere), and wildcard certs are not free (but they do seem relatively cheap), but it might be worth looking into for someone in your position.

Re:Google SSL Search by thepsi on Wednesday May 11, 2011 @08:44AM (#2536185)
I've used them for a few personal sites and projects with no complaints.

The fee for wildcard certs (~60USD) is a one-off to verify your identity - usually via a quick phone call to confirm details from your official documents.

Once that's complete, you can generate as many certs as you need (incl. wildcards and Subject Alternative Name) from their control panel, subject to jumping through the usual hoops to prove that you have control of each domain.

Re:Google SSL Search by dspillett on Wednesday May 11, 2011 @12:13PM (#2537000)
I'd not picked up that the wildcard fee was a one-off - that makes it all the more attractive.
Re:Google SSL Search by RyanKearney on Wednesday May 11, 2011 @12:32PM (#2537083)
I do use StartSSL but the problem just comes from having multiple sub domains. I get IPv4 addresses for $0.50/mo/each but I'd rather not setup each subdomain on its own dedicated IP for the sakes of using free SSL certs.
Re:Google SSL Search by dspillett on Wednesday May 11, 2011 @07:36PM (#2538876)
You don't need multiple IPv4 addresses to make use of a wild-card (or other multi-name) certificate. A wildcard certificate will verify any matching domain so you could have many sub-domains of the same domain (using a single certificate for *.domain.tld) on one address and browsers would not complain.

Also you could run the distinct (sub)domains on different ports on the same address, though this is perhaps less useful.

Also, with SNI you can use many single-name certificates on one address (and all on the same port) using SNI. Unfortunately there are a number of significant client combinations that won't play nice with this (most notably, if you can't guess, IE on Windows XP): http://en.wikipedia.org/wiki/Server_Name_Indication#Support

Re:Google SSL Search by RyanKearney on Wednesday May 11, 2011 @09:48PM (#2539199)
I know that. I'm saying I don't want to have to pay for a wildcard certificate since you can get free certs for individual domains. The alternative for me purchasing a wildcard domain would be to get many different single domain certs for free and assign each one to a different IP address.