<story><title>Switch to HTTPS Now, For Free</title><url>https://konklone.com/post/switch-to-https-now-for-free?hn</url></story><parent_chain><item><author>jakobe</author><text>I just recently enabled SSL on my business website. It was anything but simple.&lt;p&gt;First of all, I had to get a dedicated server, because a bunch of other sites were running on the same server, and the hosting company doesn&amp;#x27;t offer additional IP addresses.&lt;p&gt;Then I wanted to get an SSL certificate. I picked Comodo, because they seemed to offer the cheapest full business validation certificate, but then accidentally bought a domain only certificate because their marketing was so confusing. Their friendly customer service walked me through a complicated process for changing my order.&lt;p&gt;To get the certificate issued, it took me a week to collect the documents they requested. I had to make sure my business was listed in the yellow pages, so they could send me an automatic phone call for verifying my number.&lt;p&gt;After every step in the process, they told me to log into their online management area, which was offline from time to time.&lt;p&gt;I had to confirm my email address by clicking a link about a dozen times. Half of the emails were missing the confirmation link.&lt;p&gt;Twice I got an email telling me my order will soon be processed, and nothing happened for two days. I had to open tickets in some online support area or send them emails to get them to continue processing.&lt;p&gt;All in all it took me a month to get SSL working. Now I understand why so many sites do not use HTTPS.</text></item></parent_chain><comment><author>dpe82</author><text>Someone should probably point out: most of your problems were related to doing full business validation from a crappy provider. Business validation is optional and doesn&amp;#x27;t enhance the transport-layer security benefits of using SSL.</text></comment>
<story><title>Switch to HTTPS Now, For Free</title><url>https://konklone.com/post/switch-to-https-now-for-free?hn</url></story><parent_chain><item><author>jakobe</author><text>I just recently enabled SSL on my business website. It was anything but simple.&lt;p&gt;First of all, I had to get a dedicated server, because a bunch of other sites were running on the same server, and the hosting company doesn&amp;#x27;t offer additional IP addresses.&lt;p&gt;Then I wanted to get an SSL certificate. I picked Comodo, because they seemed to offer the cheapest full business validation certificate, but then accidentally bought a domain only certificate because their marketing was so confusing. Their friendly customer service walked me through a complicated process for changing my order.&lt;p&gt;To get the certificate issued, it took me a week to collect the documents they requested. I had to make sure my business was listed in the yellow pages, so they could send me an automatic phone call for verifying my number.&lt;p&gt;After every step in the process, they told me to log into their online management area, which was offline from time to time.&lt;p&gt;I had to confirm my email address by clicking a link about a dozen times. Half of the emails were missing the confirmation link.&lt;p&gt;Twice I got an email telling me my order will soon be processed, and nothing happened for two days. I had to open tickets in some online support area or send them emails to get them to continue processing.&lt;p&gt;All in all it took me a month to get SSL working. Now I understand why so many sites do not use HTTPS.</text></item></parent_chain><comment><author>dangrossman</author><text>I would be willing to bet over 95% of SSL-secured sites don&amp;#x27;t have business validation certificates. Given virtually nobody visiting your site will know what that means, let alone how to check anything about the certificate you&amp;#x27;re using, it just doesn&amp;#x27;t make sense to pay extra for no benefit. A domain-validated certificate costs less while providing the same padlock icon and level of encryption, and takes just minutes to obtain -- pay, paste a CSR, click a link in an e-mail, and you have a cert.</text></comment>