Advantages of LuxSci/Thawte SSL Certificates over Go Daddy

More...

We are often asked by customers why they should pay more for an SSL certificate from LuxSci/Thawte instead of purchasing from a third party provider like Go Daddy. I.e., what justifies the added expense?

There are two key considerations in choosing Thawte SSL from LuxSci:

The recognition of an SSL certificate from Thawte.
The benefit of LuxSci managing the order process, installation and subsequent SSL renewals.

The recognition of an SSL certificate from Thawte

There are many advantages to using SSL certificates from Thawte.com, which is a subsidiary of Verisign.

Highly Credible Online Security For Professional Level Websites That’s Fast, Reliable and Cost-Effective – Thawte is a highly respected and established Web Trust compliant security organization. If your website has high transaction volumes, or if you are a hosting provider with a Service Level Agreement (SLA), then Thawte can provide highly trusted professional and enterprise-class certificates.
Highly trusted and highly credible SSL Certificates – Thawte is the 2nd largest Certification Authority in the world, and Verisign is the Largest!
Single certificate install – no chained installation – Thawte uses GeoTrust’s own root SSL certificate – its root is already trusted and present in all popular browsers
GeoTrust and Thawte products are most compatible with Mobile devices with high ubiquity levels. GeoTrust owns it’s root certificates (i.e. no intermediate certificates and chains of trust are needed).
Compatible with 99%+ of all browsers and web servers
Site Seals – Thawte site seals are an effective way to make sure your customers know your site has the stamp of approval from a leading global Certificate Authority for secure e-business transactions. Their patented smart seal technology provides fast, reliable and user-friendly web site identity authentication, and instant proof to your customers that your site can be trusted.
Thawte Trusted SiteSeals are dynamically-generated when someone accesses your site, and display a live time and date stamp and/or your company name. Users can click on a site seal to display additional verification information.
Like Thawte SSL Certificates, these enhance your customer’s confidence with the prestige of the Internationally recognized Thawte brand name.

The benefit of LuxSci managing the entire process

While you can provide LuxSci with your own SSL certificate after you purchase it from a third party provider, we recommend that LuxSci purchase your SSL certificate to ensure the quickest and easiest setup experience:

We will purchase an SSL123 certificate from our partner Thawte.com (or other type of certificate if desired). Thawte SSL123 with site seal is rated one of the most popular and trusted Domain Validated Certificates in the US as well as globally.
We will take care of gathering all needed information from you and will coordinate with Thawte.
We will make sure that the certificate does not expire on you from year-to-year by tracking the certificate and coordinating renewals with you.
Your certificate will:
- Use 2048-bit keys
- Support 128-bit and 256-bit encryption
- Have the highest degree of browser compatibility available
- Not require any intermediate certificates
- Be very well trusted by your end users as it will be issued by Verisign/Thawte
We will bill you for the certificate — so you pay us for your certificate as part of your normal LuxSci invoice.
You get a discount on the monthly cost of the required associated dedicated IP address.
You have a single point of contact for support and billing for your services — LuxSci.
Certificate ordering, renewal, and maintenance will be taken care of by LuxSci.

What about Go Daddy? They are “so inexpensive!”

Trust? Most people likely associate Go Daddy with their recent string of sexually-explicit SuperBowl commercials. Is this the first thing you want your customers thinking of when dealing with trusted online security?
Validation? The majority of Go Daddy’s certificates are domain-validated. They only validate that the domain is registered by performing a WHOIS lookup. If it is, the certificate is automatically sent to the email address listed for the domain. (I.e. this is not very secure)
The bulk of GeoTrust, RapidSSL and Thawte products are organization-validated products where they perform a full verification of your business, the ownership of your domain, and your authority to apply for the certificate. Their authentication procedures provide the highest level of trust in the industry. Go Daddy’s do not.
Go Daddy’s Root Certificates are not included in Safari. Therefore, almost 7% of visitors will receive error messages when accessing your site, unless you take extra steps to install additional certificate chains on the web server. This could cost a business more than any difference in certificate price.
Go Daddy’s certificates require an intermediate certificate to be installed for their use. This is because Go Daddy is down the food chain from upper level, more trusted certificate vendors. The validity of all Go Daddy certificates depends on this chain of trust remaining in place and all dependent business relationships remaining unchanged!
Go Daddy’s core business is as a domain registrar and offers SSL as an add-on. SSL has always been a core business of GeoTrust, RapidSSL and Thawte and will remain so. SSL will get less attention at Go Daddy.
Compared to Go Daddy, Thawte is under the Verisign umbrella and has more customer and technical support resources in three different geographies / time zones.

Consider the following when providing your own SSL certificate:

You have to order the certificate yourself.
You are responsible for ensuring that your certificate does not expire and you must take the initiative for renewing it.
If there are any issues with your SSL certificate, you must deal with the support from your third party provider yourself.

8 Responses to “Advantages of LuxSci/Thawte SSL Certificates over Go Daddy”

Extended Validation (EV) SSL Certificates | LuxSci FYI Says:
December 30th, 2009 at 2:11 pm
[...] SSL Certificates are issued by an Certificate Authority (CA) such as Thawte after the CA performs some basic standard validation on the identity of the certificate request to [...]
Tom Murzenski Says:
January 4th, 2010 at 9:25 am
I was able to access GoDaddy SSL pages with Safari on both Win and Mac with no problems. Is that bullet point still valid?
Erik Kangas Says:
January 4th, 2010 at 9:33 am
Thanks Tom,

I researched this and what was actually meant was that Safari (and some other browsers) will not recognize the Go Daddy certificate as valid unless additional “intermediate” certificates are installed on the web server. If you do not install the certificate chain that makes Go Daddy “valid”, then you will get warnings in these browsers (not not in newer versions of Internet Explorer and FireFox, for example).

I have revised the post to be explicit about that.
Secure Web Pages and Web Forms: What You Need to Know | LuxSci FYI Says:
January 5th, 2010 at 5:33 pm
[...] get an SSL certificate, you can either order one directly from a third party, like Thawte, or contact your web hosting provider and to see if they can obtain one for you. In either case, [...]
Scmeeven Says:
January 7th, 2010 at 10:39 am
LuxSci’s $149 cert is the Thawte 123 cert, which is a domain validated cert. GoDaddy’s entry level cert is also domain validated. The other key point was about Thawte owning the trust root. GoDaddy claims the same about its certificate authority too: http://www.godaddy.com/gdshop/ssl/ssl.asp?ci=9039

So, on these two points, there isn’t any difference between Thawte and GoDaddy. In fact, GoDaddy is much cheaper at $99.

Is it possible that intermediate certs are still required for certs even from authorities who have their own trust roots? GoDaddy seems to require intermediate certs. If GoDaddy’s certifying authority owns their trust root, why are the intermediate certs required?

The other points in this article are all very valid. GoDaddy’s horrible commercials alone are enough reason for a self-respecting business not to touch their services.
Erik Kangas Says:
January 7th, 2010 at 12:09 pm
One difference between Thawte’s and Go Daddy’s domain validation is the degree of checking that is done. I believe Thawte accepts only a narrower range of email addresses in the domain for validation and works a little harder to ensure that the validation is proper. I woudn’t trust Go Daddy’s validation as it much more or all automated.

Regarding the trust root, this may have changed, we’re just reporting what Thawte has told us. For example, for EV certificates, it does look like Go Daddy is the “trust root” for its own EV SSL Certificate. It is quite likely that for other certificates, that it is not the trust root. The intermediate certificate is required for your browser to accept these other certificates as valid. You can check the certificate chain yourself. In FireFox, for example,
* Double click on the “lock” icon.
* Click on “View Certificate”
* Click on “Details”.
* See the “Certificate Hierarchy”.

One Go Daddy site I looked at had a chain of several Go Daddy authorities. In cases where Go Daddy does own the trust root, that they make make other certificates for signing specific kinds of certificates. In this cases, they would need to sign these other certificates with their own Trust root and provide an intermediate certificate so that the browser / server would have the full chain. I.e. this is a case where intermediate certificates would be required even for places that have their own trust root which is actually trusted — because they are not signing your certificate directly with that trust root.
Scmeeven Says:
January 8th, 2010 at 12:28 pm
That’s interesting about the stricter domain validation process of Thawte.

>>because they are not signing your certificate directly with that trust root.
I recollect reading somewhere that NOT signing the certificate directly with the original trust root is actually more secure than doing so because it prevents the original root from being compromised, ever.

Comodo swears by this. Their entire range of certs (even EV SSL certs) require intermediate certs. In fact, I just had it confirmed by the Comodo partner support person that their only reason for this is a policy decision never to sign any cert with the original trust root and that even Verisign had changed its policy as of last year.
Jim Williams Says:
February 1st, 2010 at 1:30 pm
I’ve seen the “stricter domain validation” argument several places.

The real question is this — does anyone really care? How many consumers bother to click through to see where your SSL cert came from? How many consumers will even recognize the CA’s?

I suspect very few on both counts.

Does anyone have any data to the contrary?

You must be logged in to post a comment.

LuxSci FYI