SSL FAQ About SSL Review Advertise on SSL Review Contact Us at SSL Review Home  
The SSL Certificate & Certification Authority comparison website

Credibility and Stability of Supplier

  • Trust comes from credible, established and stable CAs

Is the CA established and does it own its own trusted root?
Business stability is an essential component when selecting any supplier. Whilst SSLreview does not examine financial stability of each CA in detail (enterprise class accounts are advised to conduct their own due diligence into each CA), it does examine the root CA certificate ownership.

You can examine trusted root ownership by double clicking the padlock in your browser when you have an SSL connection with a webserver. When the SSL Certificate appears, simply click the "Certification Path" tab to see which trusted root CA certificate issued the SSL certificate.

The Verisign trusted root
Verisign owns its own root.

The Equifax trusted root
GeoTrust owns the Equifax root (Equifax Digital
Certificate services became GeoTrust in 2001)

The Thawte trusted root
Thawte owns its own root. Thawte is owned by Verisign.

The Baltimore trusted root
Cybertrust owns the GTE CyberTrust root (Cybertrust
bought GTE CyberTrust in 2003)

The Entrust trusted root
Entrust owns its own root.

The GlobalSign trusted root
GlobalSign owns its own root.

The IPSCA trusted root
IPSCA owns its own root.


What to consider…
When selecting a CA, always consider the long term stability of the CA, especially if you require longer term enterprise solutions.

If the CA relies on an intermediate certificate - consider the long-term stability of the CA supplying the intermediate, and obviously the stability of the supplier relationship between the two CAs.

Credibility & WebTrust Compliance
The key issue for long term stability of a CA is whether they have achieved WebTrust compliance. As well as assuring the relying party (e.g. your customers) that your SSL certificate has been issued by a CA that has been regulated and is audited by AICPA/CICA, you are also assured that the CA is both financially and technologically sound and has standards in place to ensure its ongoing operation.

Microsoft have stated that by 2004 all non-WebTrust compliant CAs will have their trusted root CA certificates removed from Internet Explorer. If your SSL certificate has been issued by a non-WebTrust compliant CA, and the CA's trusted root is revoked, your SSL certificate will also be revoked.

Clearly you should consider this fundamental future proof issue when selecting your SSL provider.

What does it mean to be WebTrust compliant?
"The WebTrust Seal of assurance for Certification Authorities symbolizes to potential relying parties [e.g. your customers] that a qualified practitioner has evaluated the CA's business practices and controls to determine whether they are in conformity with the AICPA/CICA WebTrust for Certification Authorities Principles and Criteria. An unqualified opinion from the practitioner indicates that such principles are being followed in conformity with the WebTrust for Certification Authorities Criteria. These principles and criteria reflect fundamental standards for the establishment and on-going operation of a Certification Authority organization or function."




CyberHostplus - Your One Stop Hosting Solution

YourDotCom 800 427 1165 Web hosting for business!
スポンサー  -  providing high quality web services at super low prices,,,



SSL証明書|ジオトラスト FreeSSL事業部
© Copyright 2003 SSL Review. All Rights Reserved.