I don't think it matters whether you use SHA1 or SHA256 on your CSR - a CA can issue you a SHA256 certificate regardless. Better to use SHA256 on the CSR, of course, but not worth worrying about.
Besides that, you might want to add a 301 URL redirect to
your web server to force people to only use SSL and avoid
the fatal mistake of someone forgetting to type http_s
Is there a best practice to prevent users making this first incorrect request in the first place?
Using HSTS and browsers pre-loaded list of sites that are HTTPS-only prevents leakage: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
Also cookies also have a 'secure' flag.
Re:Ask HN: SSL certificates
by NeutronBoy on Monday June 15, 2015 @07:13PM
(#9722786)
> Besides that, you might want to add a 301 URL redirect to your web server to force people to only use SSL and avoid the fatal mistake of someone forgetting to type http_s_.
Is there any advantage of this over doing it at a DNS level?
CertSimple and DigiCert seem to be a bit pricey for simple DV (Domain Verification) certificates, any other options in that area?
Re:Ask HN: SSL certificates
by bobwaycott on Monday June 15, 2015 @01:32PM
(#9720760)
thanks for a great reply on all points.
2) For lowest cost and no bullshit, I'd go with CertSimple (https://certsimple.com), or DigiCert (https://digicert.com).
3) As mentioned below, SSLLabs will point out if any of your config is risky. Besides that, you might want to add a 301 URL redirect to your web server to force people to only use SSL and avoid the fatal mistake of someone forgetting to type http_s_.
Have fun!