В своей основе сертификаты делятся на два типа – Single Root и Chained Root SSL. Single (одиночные) Root Certificates как правило считаются более безопасными и более предпочтительными чем сертификаты Chained (промежуточные) Root SSL. Хотя сами Chained Root SSL сертификаты тоже довольны эффективны и безопасны так как они основываются только на доверенных корневых Trusted Root сертификатах.

Chained Root SSL Certificate

Single Root SSL Certificate

Выдается центром CA, не имеет собственного доверенного корневого сертификата Trusted Root CA Certificate Признается не всеми браузерами, Chained Root SSL зависят от оригинала Trusted Root CA владельца сертификата для признания браузера Не очень надежный; Chained Root SSL сертификаты становятся недействительными как только истекает Trusted Root CA сертификат на базе которого он действует Сертификат может истечь раньше в зависимости от срока действия Trusted Root CA Certificate При установке могут возникнуть проблемы, поскольку она должна проводиться на веб-сервере так же как на сайте. Для инсталяции нужен технический специалист, так как недоступна премиум -установка. Могут работать или нет в стандарте шифрования 128/256 Bit Требуются бумажные документы, выпуск занимает продолжительное время Как правило не предусматривают никакой страховки Отсутствуют гарантии Бесплатная печать сайта может предоставляться или нет Сравнительно низкие цены

Выпускается центром CA как собственный корневой сертификатTrusted Root CA SSL Certificate . Признается практически всем популярными браузерами; большинство Single Root SSL сертификатов имеет 99.9% уровень признания браузерами. Высокая надежность; центр CA выпускающий Single Root SSL сертификат работает стабильно и организованно Выпущенные сертификаты имеют такою же силу как и Trusted Root CA сертификат Чрезвычано просты в установке, могут быть установлены без помощи технического специалиста. Доступны Premium Installation пакеты для установки Стандартное шифрование 128/256 Bit Не требуется предоставление бумажных документов. Большинство Single Root SSL сертификатов выпускается в считаные минуты Большинство Single Root SSL сертификатов имею страховку Покрывается гарантией Включена бесплатная печать сайта Site Seal. Визуально сразу же удостоверяет посетителя о безопасности сайта. Цены более высокие, но и надежность и гарантии для пользователей соответственно выше.

Trusted Root – what is that? This is a question that might stump most people, even those who might be well acquainted with the internet. The reason for this is that Trusted Root is not an oft used term. Trusted Root refers to Trusted Root Certificate which is related to website security. A Root Certificate is either an unsigned public key certificate or a self-signed certificate. It is generally part of a public key infrastructure scheme. A company that owns a Root Certificate is generally called a Certification Authority because it normally has rights to issue multiple certificates based on its Root Certificate. When the Root Certificate is widely recognised and trusted, it automatically becomes a Trusted Root Certificate. Every website that involves online transactions, either monetary or information related requires a secure way of transmitting data. This is achieved through data encryption which is also known as “Secured Socket Layer” or SSL. When a website is SSL secured, the indication for this is generally in the form of an SSL certificate. SSL Certificates can only be issued by the Certification Authorities. As stated above, the CAs would normally own a Trusted Root CA Certificate. For an SSL certificate to be really effective, the Trusted Root CA Certificate on which it is based must be recognised and present in all web browsers. Let us understand the reason behind this… When a website with an SSL certificate is loaded into the web browser, it is the web browser that decided whether to accept the SSL certificate or not. For this decision, the web browser generally turns to its internal records of Trusted Root Certificates. Every browser comes with a list of Trusted Root Certificates which are pre-recorded and recognised by the browser vendor. another is chained root certificate . If the Trusted Root CA Certificate of an SSL Certificate is present in the web browser, the SSL Certificate will be recognised and accepted by the browser. The more number of browsers in which the Trusted Root CA Certificate is present, the higher the acceptance of the SSL Certificates issued by that CA! This is known as “browser ubiquity”. Most of the major current CAs such as VeriSign, GeoTrust, Thawte, RapidSSL, etc. can claim 99.9% browser recognition rates. This is because they have been around for a long time and have now formed relations with most browser vendors who recognise these CAs are being trustworthy and stable. As a result, whenever the browser vendors create a new version of their browsers, they automatically include the Trusted Root CA Certificates of these CAs in the list of recognised Trusted Root Certificates. When an SSL certificate is based on a Trusted Root CA Certificate, the website into which it is integrated becomes that much more trustworthy and secure. The stability and trustworthiness of the CA in turn carries through to the website and inspires trust in website visitors. If you have a website for which you are looking to get an SSL certificate, you should ensure that the SSL certificate you opt for is issued by a CA that owns its Trusted Root CA Certificate. Only such an SSL certificate can provide you industry standard security. The debate over Chained Root SSL Certificates and Single Root SSL Certificate has been waging ever since SSL Certificates came into existence. Most website owners prefer to get a Single Root SSL Certificate for their website because of the fact that such certificates provide additional benefits and have certain plus points over Chained Root SSL Certificates. Single Root SSL Certificates are generally issued by Certification Authorities (CA) that own their Trusted Root CA Certificates. This makes Single Root SSL Certificates much more trusted and secure. On the other hand, CAs that issue Chained Root SSL Certificates may or may not own their Trusted Root CA Certificate. Single Root SSL Certificates are preferable on account of the numerous benefits they carry. Chained Root SSL Certificates are viable only if you have a very low budget for an SSL certificate. There are several other similar points of differentiation that give Single Root SSL Certificates an edge over Chained Root SSL Certificates.

SSL Certificates are issued by Certification Authorities (CA) who generally own their Trusted Root CA Certificate. When we say Trusted Certificate, it means a Root Certificate that is recognised and already present in all the browsers and other applications that require and accept security certificate. An example of such a CA and Trusted Root CA Certificate would be GeoTrust, which is one of the oldest CAs and owns its Trusted Root CA Certificate. When such a CA issues an SSL certificate, it is known as a Single Root SSL Certificate. There are several other SSL Certificate Authorities that don’t own a Trusted Root CA Certificate; or if they do, they don’t wish to issue SSL certificates based on that Root Certificate. As a result the CA links up with another CA that owns a Trusted Root Certificate and issues SSL certificates on that Trusted Root Certificate. So when the browser links with the web-server and website, it actually identifies the Chained Root SSL Certificate as originated from the Trusted Root Certificate and accepts it. Unlike the identification process of the Single Root SSL Certificate which takes less than a second, Chained Root SSL Certificates take longer time to be recognised by the browser because they have to pass through two root levels. A CA that issues Chained Root SSL Certificates is usually not recognised by the browsers and so they have to bank on those CAs that have browser recognition. This can sometimes create a problem in the sense that if the CA with the Trusted Root CA Certificate goes defunct, the Chained Root SSL Certificates issued will automatically become invalid. Additionally the owner of the Trusted Root CA Certificate has full authority to make any changes they wish to their certificate without intimating the Chained Root SSL Certificate issuing CA. Any such changes can directly affect the Chained Root SSL Certificate. You might also face a few issues with installing the Chained Root SSL Certificate on the web-server; it might require deeper technical knowledge.With all the setbacks, there are also certain benefits of Chained Root SSL Certificates. The first is that Chained Root SSL Certificates cost comparatively lower than the Single Root SSL Certificates. So if you don’t have the budget for a Single Root Certificate, a Chained Root Certificate can easily fulfill your requirements. Being based on a Trusted Root CA Certificate, Chained Root SSL Certificates generally work on industry standard 128 Bit encryption and security. This makes them just as secure as Single Root SSL Certificate. If you are a start-up e-commerce website or a comparatively smaller one looking to grow, you can definitely get started with a Chained Root SSL Certificate. Though ideally you would be looking to get a Single Root SSL Certificate as it is the best you can get for your website. In cryptography and computer security, a root certificate is either an unsigned public key certificate or a self-signed certificate that identifies the Root Certificate Authority (CA). A root certificate is part of a public key infrastructure scheme. The most common commercial variety is based on the ITU-T X.509 standard, which normally includes a digital signature from a certificate authority (CA). Digital certificates are verified using a chain of trust. The trust anchor for the digital certificate is the Root Certificate Authority (CA). A certificate authority can issue multiple certificates in the form of a tree structure. A root certificate is the top-most certificate of the tree, the private key of which is used to "sign" other certificates. All certificates below the root certificate inherit the trustworthiness of the root certificate - a signature by a root certificate is somewhat analogous to "notarizing" an identity in the physical world. Many software applications assume these root certificates are trustworthy on the user's behalf. For example, a Web browser uses them to verify identities within SSL/TLS secure connections. However, this implies that the user trusts their browser's publisher, the certificate authorities it trusts, and anyone the certificate authority may have issued a certificate-issuing-certificate, to faithfully verify the identity and intentions of all parties that own the certificates. This (transitive) trust in a root certificate is the usual case and is integral to the X.509 certificate chain model. The root certificate is usually made trustworthy by some mechanism other than a certificate, such as by secure physical distribution. For example, some of the most well-known root certificates are distributed in the Internet browsers by their manufacturers.

Root certificate. Mozila FireFox Certificate List