Re:Ask HN: SSL certificates
by colinbartlett on Monday June 15, 2015 @12:11PM
(#9720265)
I deploy a couple of new projects every month and I've gotten into a habit of HTTPS full time everywhere on all projects.
From my experience using SSL Lab's web-based test[1] on all of them, the issue is less with the cert vendor and more with the server configuration. All the vendors I have used recently will use a 2048 bit RSA key which will grade as A just fine on SSL Labs. But it's pretty easy to get lower grades by not having an up-to-date server which restricts broken ciphers like TLS 1.0 and SSL. Or by having broken certificate chains.
My favorite vendor is DNSimple because of their extremely easy process for generation, but they are just reselling Comodo certificates.
From my experience using SSL Lab's web-based test[1] on all of them, the issue is less with the cert vendor and more with the server configuration. All the vendors I have used recently will use a 2048 bit RSA key which will grade as A just fine on SSL Labs. But it's pretty easy to get lower grades by not having an up-to-date server which restricts broken ciphers like TLS 1.0 and SSL. Or by having broken certificate chains.
My favorite vendor is DNSimple because of their extremely easy process for generation, but they are just reselling Comodo certificates.
1. https://www.ssllabs.com/ssltest/