I’m bootstrapping my own project, it has a registration/login area (via devise with RoR, properly hashed and salted of course). As I’m using subdomains and I need to access them with iframes (it’s justified, really!) I’d need one of those expensive certificates that cover subdomains.

As I’m doing this out of my own time and money, so I’m hesitant to drop a couple of hundreds on a certificate, plus a couple of hours delving into something I haven’t tried before. I’m not storing any sensitive information besides the email address and the password. As far as I understand, the only vulnerability happens when a user logs or signs up from an unencrypted network (such as a coffee shop) and someone is listening the network.

Am I being cheap? Is this something I should tackle before releasing into the wild (and having no guarantee that it’s going to catch on?).

View thread on r/webdev

You can’t just self sign your own certificate for now?

I had no idea you could self sign a certificate, I’m going to look into this!

View thread on r/webdev

u/zerosignalproduction:

Who says you need to buy a certificate for a couple hundred dollars? There are plenty of different types of certificates to purchase, many of which are less than $20. The only thing that the more expensive certs seem to get you is extended validation, or the “green bar” in browsers. Otherwise, a cheap one should work just fine.

Check out CheapSSL

$80-$85 per year for a wildcard SSL is not bad at all, I might just cave in for this.

View thread on r/webdev

u/bsock:

if you’re collecting pii you should be using a cert. birthdays, names, anything that could be used to help an identity thief.

By that logic blog comments should go through SSL

View thread on r/webdev

u/absolutedestiny:

http://www.startssl.com/ have a free certificate that will get you a blue bar. They are excellent and you can easily upgrade later if you need to.

Thanks, in the end I got a certificate from startssl.com just to get a feel of installing the certs and keys, and here it is in all it’s glory https://method.ac.

I still have to drop around $25/y for the wildcard one that supports subdomains, but it’s 10x less that what I expected to pay, thanks!

View thread on r/webdev