SSL FAQ

When a client (internet user) attempts to access a website that is equipped with a working SSL Certificate, the client's browser initiates the following steps:

Hide

There are three main types of SSL Certificates:

Wildcard SSL & Multi-Domain SSL are extra features offered by Certificate Authorities to manage multiple functions with a single certificate.

Hide

An SSL certificate file contains a digitally signed cryptographic key. This cryptographic key contains the following information:

Hide

It depends on your needs. Any user can get a free SSL certificate. They are accepted by all browsers. However, free SSL certificates have some limitations such as:

Hide

A Site Seal is a symbol of online trust that indicates an organization has taken steps to protect its customer's security & online reputation. It helps offer customers greater assurance while doing transactions.

Hide

Root Certificate: In public key infrastructure, a root certificate is an unsigned public key certificate or a self-signed certificate that identifies the root Certificate authority.

Intermediate Certificate: Intermediate certificates are used to keep root certificates secured behind various security layers to ensure that the keys are not accessible. They act as a bridge between root certificates and SSL certificates.

Hide

To display your organization's name in the address bar, you will need to secure your website with an Extended Validation (EV) SSL Certificate.

Hide

An encryption key is a digital file used to control the encryption (and sometimes decryption) of data. The use of an encryption key and an encryption protocol (like SSL/TLS) turns plain text into cipher text, allowing for secure transmission of data. The strength of encryption keys are measured in bits (2048-bit, 4096-bit, etc).

Hide

SHA stands for Secure Hash Algorithm.

SHA-1 Algorithm: SHA-1 is a cryptographic hash function that delivers security with its 160-Bit hash value. Is carries a 40 digit-long hexadecimal number (SHA-1 is now obsolete).

SHA-2 Algorithm: SHA-2 is a cryptographic hash function that carries hash values of 224, 256, 384 and 512-Bits. This is the new industry standard and highly recommended.

Hide

Multi-year SSL Certificates offer significant advantages of over Single-year SSL Certificates—you save money as certificates with longer lifespans are typically sold at a lower cost per year than their single-year counterparts. Plus, you won’t need to go through the purchasing process as frequently, saving you time.

Hide

The SSL protocol uses "asymmetric encryption" which relies on two different encryption keys. One key handles encryption (the public key) and the other key handles decryption (the private key). This encryption method allows two devices to securely communicate without any prior interaction.

Public Key: This key is part of your SSL certificate and is available to every client that connects to your server. The client encrypts their data with the public key, and then transmits it across the internet.

Private Key: This key is generated by you (the owner of the certificate/server) and should be kept securely. When data encrypted by your public key reaches your server, the private key is used to decrypt that data so it can be read. Never share your private key with anyone or transmit it over an insecure format (like email). If someone else gets a copy of your private key, they can decrypt all the information sent to your server. If this happens, please reissue your certificate with a new CSR to pair it to a new key.

Hide

Wildcard SSL certificates are a type of certificate which allow you to secure an unlimited number of Sub-Domains at a specific level (i.e. Domain Validation or Organization Validation, Wildcard SSL Certificates are not available at the Extended Validation level).

Using wildcard SSL a user can secure

Hide

Multi-Domain SSL Certificates are a special type of certificate that allow you to secure your main domain and additional fully qualified domain names on a single certificate.

Using Multi-Domain SSL a user can secure

With Multi-Domain SSL Certificates, you can generally secure up to 250 domains depending on the issuing Certificate Authority (CA).

Hide

Extended Validation or EV SSL Certificates provide the highest level of trust and are known for providing legitimacy to the business or organization behind the websites they protect. To receive an EV SSL Certificate, the applicant needs to complete a stringent authentication process that's set forth by the issuing Certificate Authority (CA); additional legal business registration documents may be required for completion. However, don't let this scare you. For any business with its registration information up to date, this process is a breeze.

Hide

Domain Validated (DV) SSL Certificates are entry level certificates that mainly focus on providing encryption, but offer very little authentication. To receive a DV certificate, the applicant only needs to demonstrate domain ownership.

Organization Validated (OV) SSL Certificates are standard SSL certificate which validate the identity of the business or organization behind the website via government registration directories or documents. This type of SSL certificate creates a higher level of online trust & confidence compared to DV SSL certificates since the legitimacy of the business is verified by the issuing Certificate Authority and the company's information is displayed within the certificate subject details.

Hide

E-commerce businesses need a complex, trusted security environment since their website(s) have to deal with exchanging confidential user information and settling financial transactions. An Extended Validated (EV) SSL certificate is a perfect solution for creating a trusted security environment in an E-commerce business since online trust and confidence are established through verified organization details.

Hide

Almost all web servers, mobile servers, mobile OS, and Desktop base OS support SSL Certificates.

Hide

All leading SSL Certificate Authorities (CAs) are trusted and their SSL certificates considered secured. As per W3Tech's recent survey on SSL Certificate Authorities, DigiCert is the most popular commercial SSL provider. To view the survey, please click the link below: https://w3techs.com/technologies/overview/ssl_certificate/all..

Hide

A web user's server, database and network devices are vulnerable to cyber attackers. A vulnerability assessment will help users find critical weaknesses in their website, database, network devices, and servers.

Hide

SSL Certificates encrypt & secure any data transmitted between a client's web browser and web servers once properly installed/configured.

Site Seals are an online trust symbol that allows websites to display real-time data updates verifying their business' legitimacy and website details which increases online reputation, confidence, and conversion rates.

Hide

To secure multiple domains with a single SSL certificate, you must purchase a Multi-Domain (SAN) SSL certificate. This certificate type will allow you to manage and secure multiple domains under one certificate, which not only saves you time and money, but the headache of repeating the SSL process multiple times.

Hide

In actuality, the warranty is insurance that protects the CA should they make a mistake. Symantec™ takes it a step further, for an additional cost, by providing insurance to protect a compromise of a private key or loss of a certificate. The warranty level specifies the financial protection awarded to end user customers against the CA miss-issuing an SSL Certificate. If a customer suffers financial loss as a direct result of relying on information within a miss-issued SSL Certificate, that loss is protected by insurance held by the CA to cover related claims.

Hide

Certificate prices can vary dramatically between CAs–some may cost as much as 40 times more than others! The most important factors are typically the specific application and the source, meaning the need for a known brand certificate that has been issued from a highly trusted and credible CA. SSL certificates are designed for specific environments–some are ideal for development while others are for government or large enterprises. Still others are perfect for sites handling low-volume, low-value transactions. These are all things to consider before making your choice.

Hide

There are two primary certificate strengths available–40-bit and 128-bit. Today you can also get 256-bit with the use of specific browsers (currently Firefox) and a specific web server (currently Apache). All RapidSSL.com and GeoTrust certificates support 256-bit encryption.

The bit size indicates the length of the key size used for encryption during a secure SSL session. To see the current encryption strength simply hover the mouse over the gold padlock.

Hide

If your login credentials are not working, you can reset your password or email us at [email protected] and reference your issue.

Hide

If you have your original order number, you can use the automated password reminder system. Otherwise an email must be sent from the account's administrative email address to [email protected] that includes the original domain name it was purchased for or the original order number.

Hide

To change your order confirmation email address, simply email us at [email protected] and include the new email details.

Hide

We accept American Express, Visa, MasterCard, and PayPal.

Hide

CheapSSLSecurity.com will only accept refund requests within 15 days of the original purchase date.

To apply for a refund, please click here and select your order for cancellation. Once the request is on file, our Support Team will promptly process your request and determine if you qualify for a refund.

If you do not qualify for a full refund, we can alternatively apply the amount towards store credit or proceed with a replacement order.

Hide

To apply for a refund, please click here and select your order for cancellation. Once the request is on file, our Support Team will promptly process your request and determine if you qualify for a refund.

Hide

There's no limit on the quantity of RapidSSL or RapidSSL Wildcard certificates you can order. Get as many as you need! There is a limit of one FreeSSL certificate per domain name. FreeSSL is strictly a test certificate so you can evaluate using RapidSSL.com for your production certificates.

Hide

With Organizational or Extended Validation SSL Certificates, Certificate Authorities (CAs) will verify applicants' business details using online government business registration databases (i.e. Secretary of State, Companies House, KvK, etc.). If the CAs cannot verify the necessary details, additional business registration documents may be required.

If CAs are authenticating a Domain Validated (DV) SSL Certificate, business details will not be required and applicants will only need to demonstrate domain ownership. To complete this simple requirement, applicants can either prove ownership via Email-Based Authentication or File-Based Authentication.

Hide

Yes. Ideally, the CA would like your domain registrar information to be publicly viewable. However, if you have a privacy setting enabled on your WHO.IS record, applicants can alternatively demonstrate domain ownership through one of the five pre-approved alias emails:

Once the domain confirmation email is on file, the applicant must follow simple instructions or links to verify ownership, which will satisfy this requirement.

Hide

There are several options. If you need an SSL certificate right away, immediate issuance certificates use fast validation methods. RapidSSL and FreeSSL are issued immediately. If you can wait 3-5 days, established vendors use slower traditional validation methods. Be sure to review our validation information to understand what standard methods entail and to help you ask the right questions from our vendors.

Hide

EV SSL certificates usually take 1-5 business days to get issued depending on the Certificate Authority and how cooperative the certificate applicant is.

Hide

If you are unable to generate the CSR directly on your web server and do not have proper server documentation, you can alternatively use our online free CSR Generator Tool.

Hide

While generating your CSR, please select 2048-bit as your key root length.

Hide

Using our free CSR Generator Tool, enter the appropriate certificate details and click the "Generate CSR" button. Our tool will quickly provide you with a valid CSR and private key.

Please save your CSR and Private Key on your server since this is essential during the installation process.

Hide

Since we are all human, we might accidentally lose or delete the important Private Key–it happens. If this happens to you, please create a new CSR directly on your server and reissue your SSL certificate. During the process of making a new CSR, your server will automatically make a new Private Key which will correlate with the new reissued SSL certificate during installation.

Hide

You can save your private key file on your PC, server directory, or hard drive.

Hide

To check the information encoded in your CSR, please visit our CSR Decoder Tool and simply paste the CSR into the blank box, then click Check.

Hide

If the CSR and private key do not match, please create a new CSR & private key. Unfortunately, there is no quick and easy way to fix a mismatch.

Hide

It is either missing one or more required fields or the CSR contains non-alphanumeric characters in the required fields.

Hide

No. The SHA-1 algorithm is no longer considered secure or trusted by most popular web browsers such as Mozilla, Chrome, Internet Explorer, Safari, etc. We recommend updating your SSL certificate to SHA-2 since this is the new industry standard hashing algorithm.

Hide

Firefox may trigger a "Secure Connection Failed" error if a secured connection cannot be established. To troubleshoot this warning, reference this link and perform the following steps: https://cheapsslsecurity.com/blog/troubleshoot-secure-connection-failed-error-firefox/.

Hide

If your website isn't displaying the 'site lock' properly or providing the correct information, contact the issuing Certificate Authority and inquire about your issue.

Hide

Some servers require an SSL certificate to be in a particular format. To change the SSL certificate extension, use the free SSL Converter Tool on CheapSSLSecurity.com.

Hide

The easiest way is to create a new CSR on the new machine and have the certificate re-issued.

Hide

Before installing an SSL Certificate on your server, make sure you complete the following steps:

Hide

Most SSL certificates are issued by Certificate Authorities (CAs) who own and use their own Trusted Root CA certificates. GeoTrust and RapidSSL are well known to browser vendors as a trusted issuing authority so their Trusted Root CA certificates have already been added to all popular browsers establishing immediate trust. These are "single root" SSL certificates. RapidSSL is a subsidiary of GeoTrust and owns the Equifax roots used to issue its certificates.

Some CAs don't have a Trusted Root CA certificate present in browsers or don't use the root they own. Instead they gain trust for their SSL certificates by using a "chained root." A "chained root" SSL certificate is issued by a CA with a Trusted Root CA certificate and basically "inherits" the browser recognition of the Trusted Root CA. It's more complicated to install chained root certificates and not all web servers are compatible with them.

CAs who have and use their own Trusted Root CA certificate already present in browsers are known to be stable, credible companies with direct and long-established relationships with all the popular browsers like Microsoft and Netscape.

Hide

The installation process for an SSL certificate will be different for various web servers and devices. Here's a list of SSL certificate installation guides; select your server name, perform the recommended steps and complete the installation process in minutes - SSL Certification Installation Guides.

Hide

To check installation of the SSL Certificate, use our free SSL Checker Tool and click here.

Hide

All CAs provide some form of support but you'll want to know if it includes web-based, email, phone support or some combination. You also want to know if there's an extra fee for phone support as some CAs charge extra. Installing an SSL certificate requires you to first generate a CSR and then install your issued certificate. It's sometimes tricky so it's important that the CA provides prompt support. In most cases you can find the help you need in the extensive online knowledge bases offered by CAs but, if not, you want to be able to access their technical staff quickly and easily.

Hide

FreeSSL certificates are valid for 30 days. RapidSSL certificates are valid for 1 to 4 years (bundle certificates). Our Professional Level Certificates from GeoTrust, Thawte, Symantec and Comodo are available for up to 4 years (bundle certificates). We will give you instructions on how to renew when your certificate expires.

Hide

Renewing an SSL Certificate is very similar to the original SSL process. With renewals, users will have to purchase, generate, validate, and install the renewal SSL certificate. The benefits potential benefits with renewing an SSL certificate are discounts, additional time added, less validation requirements, and confidence that your SSL is properly configured before your website goes down.

Hide

Depending on the Certificate Authority, previous validated documents can be used to complete or expedite the renewal process. However, if any certificate details change or any information becomes outdated, additional documents may be required.

With Extended Validated (EV) SSL certificates, Certificate Authorities can reuse previously submitted documents if the original validation process was completed within the last 13 months. If the renewal order is generated after 13 months from the original order, new documents will be required.

With Organization Validated (OV) SSL certificates, Certificate Authorities can reuse previously submitted documents if the original validation process was completed within the last 27 months. If the renewal order is generated after 27 months from the original order, new documents will be required.

Hide

Yes, you can use the old CSR when generating the renewal SSL Certificate, however, the older private key that will be used to install the renewal certificate is considered less secure, so this is not ideal for security reasons. We recommend creating a new CSR and Private Key when completing the renewal process.

Hide

Code Signing Certificates are like digital "shrink-wrap" for software/application/files, which allows publishers to distribute their work safely & securely over the internet. These certificates provide confidence to the end-user since no code or content can be maliciously altered or tampered with for fraudulent use. Our Code Signing Certificates can secure the following platforms:

Desktop/web Based Platform:

Hide

A Code Signing Certificate can secure the following Desktop/web and mobile based platforms.

Desktop/web Based Platform:

Mobile Based Platform

Hide

Certificate Authorities typically take 1-3 business days to complete the authentication process for Code Signing Certificates. Customers must make sure to cooperate with all industry requirements and submit all required legal documents if required.

Hide

A Wildcard SSL certificate is used to secure the Root domain and an unlimited number of accompanying sub-domains. It delivers the same 256-bit encryption security across all of your sub-domains. Wildcard SSL Certificates are highly recommended to secure Blogging, CMS (Content Management System), News and Article, and Press Release platforms.

To secure sub-domains, a user needs to buy a Wildcard SSL certificate, and then when filling out the CSR use an asterisk in the place of the domain level the sub-domains reside at—for example, *. domain.com for first-level sub-domains.

This will secure an unlimited number sub-domain at the specified domain level.

Here's an example of different kinds of first-level sub-domains a user can secure using wildcard SSL:

Hide

Most wildcard SSL users are aware of its main feature, as it is used to secure unlimited first level sub-domains. But a Wildcard can also be used to secure second level sub-domains as well.

Let's look at an example

What if a user wishes to secure user-unlimited.blog.domain.com using a Wildcard SSL Certificate? The answer is, he need to buy the wildcard SSL for *.blog.domain.com.

This will allow the user to secure following formats of second level sub-domains.

Hide

No, it is not possible.

The main function of a wildcard SSL certificate is to secure unlimited sub-domains. A SAN could be a fully qualified domain (website2.net) or a sub-domain of another base domain (blog.website2.net).

So, it is simply not possible in the case of a Wildcard SSL certificate to add a SAN domain, but you can use a wildcard domain as SAN. You could also invest in a Multi-Domain Wildcard, which gives you both Wildcard and SAN functionality.

Hide

To generate a CSR for your wildcard domain, visit our CSR Generator Tool.

Now suppose a user wishes to secure his 5 sub-domains, let's say

Hide

To secure multiple domains and their sub-domains using a single SSL Certificate, CheapSSLsecurity.com is offering several products known as Multi-domain Wildcard SSL certificates.

Features of Multi Domain Wildcard SSL Certificate:

Certificate Authorities like Comodo, Symantec, GeoTrust and Thawte are offering Multi-Domain Wildcard SSL Certificates, which come available at either the Domain Validation (DV) or Organization Validation (OV) levels.

Hide

If a customer's buys a wildcard SSL certificate for *.example-domain.com, it is securing first-level sub-domains. But if a customer buys wildcard SSL for *.blog.example-domain.com, then the wildcard will be securing second-level sub-domains.

Just like with first-level sub-domains, the wildcard SSL will also work for second-level sub-domains.

By purchasing a wildcard SSL certificate for *.blog.example-domain.com, the user can secure second-level sub-domains as we explained in Questions 2.

Hide

Either one works, it frankly comes down to cost and what validation level you're looking for. If you're only going to be securing two sub-domains it may actually be cheaper in some cases to purchase single domain certificates. Keep in mind, this will mean installing three certificates and keeping track of three renewal dates though. Likewise, if you're looking to purchase Extended Validation SSL, then you will need to purchase single domain certificates as Wildcards are not available at the EV level. In most other cases though, it may still be less expensive (and involve less administrative burden) if you opt for the wildcard. Not to mention that if at any point during the lifespan of your wildcard certificate you should choose to add more sub-domains, you'd simply need to re-issue and you would have encryption for the new sub-domains as well. It all depends on your specific situation.

Hide

Yes, a user can use the same wildcard SSL Certificate with the same CSR and Private Key on different IP addresses and physical servers.

The limits on the number of physical servers and IP addresses you may use your certificate on depends on the Certificate Authority.

Certificate Authorities like Comodo, GeoTrust, RapidSSL, and Thawte offer wildcard SSL certificates with an unlimited server license policy. So, the customer does not need to face any hassle when installing a wildcard SSL certificate on multiple IP addresses and physical servers.

If you go with a Symantec Wildcard SSL Certificate, you are limited to a single server license. That means if you wish to use the certificate on another server or IP address, you need to purchase one more server license from Symantec.

Hide

A Multi-domain SSL Certificate comes with a SAN (Subject Name Alternative) feature, which allows a user to secure up to 250 domains.

Note: The numbers of SAN domain are depending on the Certificate Authority.

So, if you wish to secure 10 fully qualified domains under a single Multi-Domain SSL certificate, you need to buy a Multi-Domain SSL Certificate and 9 SAN domains. Most Multi-Domain certificates come with 2-4 SANs packaged along with them, but you will have to purchase additional SANs as needed.

Using a SAN certificate the user can secure following types of domains:

Hide

With a Multi Domain SSL Certificate, you can secure up to 250 multiple domains. (Note: you can also add a wildcard certificate as SAN domain).

Hide

Yes, a customer can add a wildcard domain as a SAN. In answer 1 we discussed all of the various formats of domains a customer can secure with a Multi-Domain Certificate.

Hide

Originally, in order to enable maximum security for Office Communication and Exchange Server users, Microsoft partnered up with a few public X.509 SSL Certificate authorities (CAs) to create UCCs (Unified Communications Certificates).

Nowadays, as SSL technology has advanced Microsoft Servers can use just about any Multi-Domain certificate—not just UCCs. Still, we sell a selection of Microsoft-suggested certificates to help you secure MS Exchange and Office Communications servers.

UCC SSL Certificates that CheapSSLsecurity.com offers:

The following Microsoft Article will help users to learn more about UCC SSL and Microsoft Office communication & Exchange server security - https://support.microsoft.com/en-in/help/929395/unified-communications-certificate-partners.

Hide

Certificate Authorities (CAs) like Comodo, GeoTrust and Thawte offer SSL certificates with unlimited server license policy. That means if you have purchased an SSL Certificate from Comodo, GeoTrust or Thawte, you can add it to any number of servers and IP addresses.

However, in the case of Symantec, there is no multiple server license policy, so you can only install your certificate on a single server. If you want to install your SSL Certificate on another server then you need to purchase a new server license.

Hide

Yes, Certificate Authorities offers Site Seals for all your SAN domains. So, you can activate site seals on all your SAN domains.

Hide