SSl certificate for company website

[cts1975]

I've recently had my company website SSL updated/installed. The company that built the site arranged this and have invoiced me £168.
Would this be the normal charge for this?
The invoice says '12 months SSL' so I'm assuming I'm going to get charged the same every year!
I've emailed the web company but had no response - however they are happy to email me a payment reminder!

[Scabutz]

Depends what type of SSL it is. Some are a lot cheaper but they only validate that the person buying owns the domains. The more expensive ones will involve the company being validated to ensure it is an active company and that the company name matches what's on the certificate. Unless you have a Bobby basic SSL its not an unreasonable amount.

I would also imagine they cat charging some fee for them getting and installing the cert, which is not particularly onerous but they will still charge.

If you plan on having the website for a while it's more cost effective to buy a SSL valid for more years, rather than renew each time.

[cts1975]

Scabutz said:

Depends what type of SSL it is. Some are a lot cheaper but they only validate that the person buying owns the domains. The more expensive ones will involve the company being validated to ensure it is an active company and that the company name matches what's on the certificate. Unless you have a Bobby basic SSL its not an unreasonable amount.

I would also imagine they cat charging some fee for them getting and installing the cert, which is not particularly onerous but they will still charge.

If you plan on having the website for a while it's more cost effective to buy a SSL valid for more years, rather than renew each time.

Thanks for the reply. I'm guessing it's a basic SSL as I've not had to validate anything other than a link to our admin@ email address.
It seems it's basic with some labour/services charged!
I was under the impression that the developer/host had to arrange the SSL?

[Scabutz]

Whoever has access to the server can get the SSL. Depends on the arrangements with your hosting company. Its not particularly hard job. You generate a certificate signing request on the server, send it to the SSL provider, they send a certificate back, you install on the server. 30 mins labour max. Some companies may just charge a minimum of an hour.

A domain validated SSL can be had for a tenner. Company validated ones are £100+

If you post (or PM if you dont want to publish here) the URL I should be able to tell you for certain what type it is.

[cts1975]

Scabutz said:

Whoever has access to the server can get the SSL. Depends on the arrangements with your hosting company. Its not particularly hard job. You generate a certificate signing request on the server, send it to the SSL provider, they send a certificate back, you install on the server. 30 mins labour max. Some companies may just charge a minimum of an hour.

A domain validated SSL can be had for a tenner. Company validated ones are £100+

If you post (or PM if you dont want to publish here) the URL I should be able to tell you for certain what type it is.

Thanks - PM sent

[bitchstewie]

There are free SSL providers.

I tend to think of it as encryption + authentication.

Paying more doesn't buy you better encryption.

Paying more may buy you better authentication and therefore give your customers more confidence when dealing with you.

Ask yourself how often you click the padlock when you're on a website to check the details

[Ean218]

Scabutz said:

A domain validated SSL can be had for a tenner. Company validated ones are £100+

Most decent C-panel accounts give you access to free Lets-encrypt certs.

[cts1975]

The only control panel I have is the Wordpress login one - can I do this myself via Wordpress?

[Zoon]

Ean218 said:

Most decent C-panel accounts give you access to free Lets-encrypt certs.

Beat me to it https://letsencrypt.org/

[akirk]

As above - lots of types of certificates and prices...
I would expect that you will pay a bit more than the cover price for an SSL certificate as there are time costs / resource costs for the company doing it - but that does seem high - what are you being charged for hosting?

[cts1975]

akirk said:

As above - lots of types of certificates and prices...
I would expect that you will pay a bit more than the cover price for an SSL certificate as there are time costs / resource costs for the company doing it - but that does seem high - what are you being charged for hosting?

Our hosting is £79+VAT per year.

[akirk]

cts1975 said:

akirk said:

As above - lots of types of certificates and prices...
I would expect that you will pay a bit more than the cover price for an SSL certificate as there are time costs / resource costs for the company doing it - but that does seem high - what are you being charged for hosting?

Our hosting is £79+VAT per year.

In that case quite surprising - as pro rata SSL certificates tend to cost less - if you can get hold of them - do query it...

[P4ulB]

Definitely check that they haven't just used LetsEncrypt - I'd be a bit miffed for being billed £168 every 12 months for a free certificate (which tend to renew themselves anyway)

[cts1975]

P4ulB said:

Definitely check that they haven't just used LetsEncrypt - I'd be a bit miffed for being billed £168 every 12 months for a free certificate (which tend to renew themselves anyway)

How can I check they are telling me the truth in terms of what certificate has been used?

[Scabutz]

cts1975 said:

P4ulB said:

Definitely check that they haven't just used LetsEncrypt - I'd be a bit miffed for being billed £168 every 12 months for a free certificate (which tend to renew themselves anyway)

How can I check they are telling me the truth in terms of what certificate has been used?

I checked it for you. It's been issued by GoDaddy so its defo not a freebie.

[cts1975]

Scabutz said:

I checked it for you. It's been issued by GoDaddy so its defo not a freebie.

Great - Thanks for responding/checking.

[cts1975]

I had a response yestreday from the company:

Hi, This is chargeable every 12 months. There are different levels of SSL, Go Daddy charge anything from $69 to $299 for an SSL.
I'm afraid this is a standard fee for our SSL's, we don't charge anything for the install and config of your SSL.

Thanks

[mikef]

The more expensive one will be an EV (Extended Validation) certificate meaning that the issuer checks that you are actually a registered company and your company name is displayed (depending on browser) along with the lock icon

I’ve used DigiCert for EV certificates https://www.digicert.com/ev-price-comparison.htm

Edited by mikef on Saturday 15th June 16:59

[jammy-git]

cts1975 said:

I had a response yestreday from the company:

Hi, This is chargeable every 12 months. There are different levels of SSL, Go Daddy charge anything from $69 to $299 for an SSL.
I'm afraid this is a standard fee for our SSL's, we don't charge anything for the install and config of your SSL.

Thanks

What sort of website are you hosting? Just a bog standard company site, or some big complicated system?



SSL certificates have nothing to do with authentication directly. They are just used for encryption of data. And yes, more expensive ones can get you better methods of encryption. Having said that, the free service Let's Encrypt is perfectly fine for 95% of use cases.

[dazmanultra]

jammy-git said:

And yes, more expensive ones can get you better methods of encryption.

Can you elaborate on this?

More expensive certificates are about validating the identity of the owner of the certificate and subsequently website; essentially whether they are who they say they are. The actual encryption used (i.e. the ciphers) is entirely down to the web browser and OS of the client accessing the site and your server. Mozilla provides a list of compatible ciphers for different browsers and operating systems here: https://wiki.mozilla.org/Security/Server_Side_TLS#... but a more expensive SSL certificate won't affect that.