how about free from cacert?

Jim, unfortunately, options that don’t have corresponding trust certificates preinstalled in web browsers aren’t all that great, because users can’t be sure that the certificate itself hasn’t been altered. (An altered cert would allow the person altering it to decrypt anything encrypted using it, defeating the point of SSL in the first place.) The CAcert root doesn’t look like it’ll make it into any web browsers in the near future — this thread is a good glimpse into what’s occurring within the (relatively open) Mozilla world, and my understanding is that nothing’s different when it comes to any of the other popular browsers. That means that it’s no different than a self-signed SSL cert from the perspective of the users at the other end of the connection — they still have to make a decision when their browsers ask them whether they want to trust the cert, and they don’t have enough information to make that decision in a way that guarantees security.

(I just reread that and realize that it sounds admonishing — I certainly didn’t mean it that way! I was just trying to convey that I’d thought about CAcert, and while I love what they’re trying to do, their effort has unfortunately not yet borne fruit that would make most people able to use CAcert certs in a truly trustworthy way.)

FreeSSL was my low-cost provider of choice - I plugged them on AskMe the last time this was asked there - and they’ve been bought by RapidSSL, so I think you should go ahead with them.

I’ve done business with all three over the years, and my current vendor of choice is RapidSSL. Their telephone verification is particularly fast and convenient. If you can set up a email address on your domain and can be reached by phone, you can get your certificate instantly. I’ve got about a dozen certificates from RapidSSL.

However, it’s exactly this convenience that led to the Mountain America phishers being issued a legitimate certificate. So if you expect your certificate provider to do more to check your trusworthiness than to merely verify the ownership of your domain, they are not the right vendor for you.

Now, there are so many CAs that we have no control over, to whom are they issuing
certificates for, their practices/policies, who has access to the private
key, so on and so forth.

At this point in time isn’t something we are willing to risk after all
the hard work people to get the PKI aworking model.

Let the CAcert come up with policies, get others motivated into helping, build up CAcert to be
trustworthy.

PKI was/is designed to protect things like non-essential passwords in email/website login and so on.., I feel their are no client applications that will warn about finger prints mismatch and hence at this point in time it’s possible to create a “man in the middle” attack by simply having a second certificate issued by any CA that’s valid in the key store.

People may have to virtually disable all root certificates in their key stores because they simply can’t trust most companies that make it into browsers, and hence PKI can’t be trusted for anything more then protecting passwords or credit card information.

Let us wait and see how the world accepts free CAs and whats the pros and cons.