btw, StartSSL offers free SSL certs that work with most browsers.
If something goes wrong then StartSSL revocation is not free but as the revocation system is pretty broken anyways u might not care, see [1] for details, if interested.
I'd use a recognized CA also for the API (smth recognized by all supported language SDKs). It can be a trouble to guide users through adding your CA as trusted CA for each case. Python, Java etc look up certs with a different strategy/have different CA truststores. For me namecheap has been one of the best offers for cheap SSL certs when StartSSL becomes too inflexible [2] or is not supported widely enough [3].
[2] Each free StartSSL domain can have exactly one alternate domain name, so you can have one cert with both template2pdf.com and www.template2pdf.com OR template2pdf.com and api.template2pdf.com OR www.template2pdf.com and api.template2pdf.com.
[3] AFAIK at least java 6 & 7 does NOT ship with StartSSL CA included in truststore.
You can. Please provide the source, I'm not aware of such constraint.
EDIT: The marketing speech that is often used to claim that more expensive certs are for more serious business is mostly baseless. Yes, you can pay to have your identity checked more carefully and pay even more to get the extended validation and a green bar, but this is "eye-candy" for most cases.
quote: Class 1 certificates are limited to client and server
certificates, whereas the later is restricted in its usage for non-commercial purpose only. Subscribers MUST upgrade to Class 2 or higher level for any domain and site of commercial nature, when using high-profile brands and names or if involved in obtaining or relaying sensitive information such as health records, financial details, personal information etc.
They certainly had issues with issuing cert for domain name suggesting it is doing financial operations, but otherwise so far every purely commercial-nature domains successfully granted certs in my case. But obviously it is startssl call and they might change their mind anytime.
Comments
btw, StartSSL offers free SSL certs that work with most browsers.
If something goes wrong then StartSSL revocation is not free but as the revocation system is pretty broken anyways u might not care, see [1] for details, if interested.
I'd use a recognized CA also for the API (smth recognized by all supported language SDKs). It can be a trouble to guide users through adding your CA as trusted CA for each case. Python, Java etc look up certs with a different strategy/have different CA truststores. For me namecheap has been one of the best offers for cheap SSL certs when StartSSL becomes too inflexible [2] or is not supported widely enough [3].
[1] http://www.ahtik.com/blog/startssl-revocation-fees-will-not-...
[2] Each free StartSSL domain can have exactly one alternate domain name, so you can have one cert with both template2pdf.com and www.template2pdf.com OR template2pdf.com and api.template2pdf.com OR www.template2pdf.com and api.template2pdf.com.
[3] AFAIK at least java 6 & 7 does NOT ship with StartSSL CA included in truststore.
You can't use the free certificate for commercial sites.
You can. Please provide the source, I'm not aware of such constraint.
EDIT: The marketing speech that is often used to claim that more expensive certs are for more serious business is mostly baseless. Yes, you can pay to have your identity checked more carefully and pay even more to get the extended validation and a green bar, but this is "eye-candy" for most cases.
Nothing at https://www.startssl.com/?app=1 tells that free Class 1 cert is not allowed for commercial purposes.
http://www.startssl.com/policy.pdf section 3.1.2.1 -- they sure don't mention that front-and-center, though.
quote: Class 1 certificates are limited to client and server certificates, whereas the later is restricted in its usage for non-commercial purpose only. Subscribers MUST upgrade to Class 2 or higher level for any domain and site of commercial nature, when using high-profile brands and names or if involved in obtaining or relaying sensitive information such as health records, financial details, personal information etc.
They certainly had issues with issuing cert for domain name suggesting it is doing financial operations, but otherwise so far every purely commercial-nature domains successfully granted certs in my case. But obviously it is startssl call and they might change their mind anytime.