Apologies for my late reply on this one – I did think I had responded to your latest comment but evidently not!

No problem, it’s my please. I’m glad that my reply reached you in time.

Im glad that my reply answered your queries – if you have any more please feel free to comment again – I promise to be more prompt with my reply!

Kind regards,
David.

Hi David,

Many thanks for a very detailed reply. I had actually forgotten about this but your reply came just at the right time!

I was puzzled by the idea of an SSL certificate that is only suitable for low traffic sites, but your explanation of it being a business benefit rather than a technical one makes perfect sense.

Tom.

Apologies for the big delay in my reply – just noticed your comment was in the moderation queue and I hadn’t been notified.

No problem, glad you found the article useful :).

In short, there is no technical reasons that this certificate would only be suitable for a site with low levels of traffic. This statement can be confidently made on a purely technical basis.

Now, what they are hinting at with the more expensive, supposed ‘suitable for high traffic / business sites’ is that there are more additional features which may, and I stress, may be beneficial from a purely business stand point rather than a technical stand point.

For example, the higher priced ( ‘business/high traffic’ ) friendly certificates normally offer a bigger warranty in the case of failure. A real world analogy for this would be the equivalent of buying an extended warranty on a new TV or computer for a yearly fee. A business, especially a larger business may want to pay more for this increased warranty – which is basically an insurance policy. It is important to note however that this insurance doesn’t cover you just because, for example, your site gets hacked. It covers the claims and assurances made by the certificate provider when they issue you the certificate.

Consequently, for a successful claim in the event of a hack, you not only have to prove that there was actually an incident (i.e. your site was hacked and it wasn’t, for example, technical failure), that the hack was successful based on the failure of the certificate and claims made by the company (i.e. a failure of the insured product), that there was no negligence on the site administrators part (i.e. misuse or incorrect use of the certificate) and most likely that you have suffered some form of tangible loss (i.e. an ‘insurable loss’ ) due to the hack – for example loss of income / profit.

In my own personal opinion this is more of a ‘feel better’ benefit in the vast majority of cases as opposed to something which is realistically likely to benefit you. The chances of a valid claimable incident are negligible at best to virtually impossible at worst (again, in my opinion) and I see this more of a business reassurance rather than an actual protection. Some people will disagree I’m sure, but definitely makes no difference of the low/high traffic margin.

Interestingly, I’ve not heard of any incidents where these warranties have been claimed on successfully, although I’d be interested to hear from anyone who has any evidence of these.

Secondly, the more expensive certificates come with ever increasingly shiny ‘protected by’ or ‘secured by’ badges. Your basically paying for brand, and nothing more in this regard.

The 123-Reg certificate is just as secure as GlobalSign ones – and any other certificate with the same encryption level.

GlobalSign is a more established and recognised brand in SSL certificates than 123-Reg so it may make less technical visitors to your website feel more ‘secure’ – however, there is no difference.

It’s the difference between buying an expensive brands t-shirt and a supermarkets own brand t-shirt – the expensive one has more street cred and looks more cool but in reality, they were probably both made in the same factory and had a different label stuck on them.

Actual tangible benefits to the more expensive certificates likely benefit businesses only. More checks are done on the more expensive certificates than on the cheaper ones – more domain, ownership, business checks etc which it could be argued increase buyer / visitor confidence that they have more assurance they know who they are dealing with.

In reality a determined scammer could probably get hold of one of these as well – and would likely go to the difficulty of it – but that’s another debate.

However, this authenticity benefit is probably not noticed much outside of the highly technical community. When was the last time you checked, asked or were told the type of SSL certificate a site uses? Probably not often, and you’d probably only notice the difference between certificates without extended validation and those with (i.e. the most expensive ones). Again, could be a benefit for business and increase visitor trust – for the relatively small number of people that would notice the difference between extended validation and no extended validation. Definitely no difference between high and low traffic sites though.

Finally, the more expensive certificates will allow multiple / wildcard domains on a varying basis. So the basic will cover domain.com, the more expensive might cover subdomain.domain.com and domain.com and the most expensive might cover all subdomains of a domain. Whether this is beneficial to you depends on if you use subdomains, how many you use and how many require a secure connection.

All in all, to conclude, there is no such thing as a ‘low’ or ‘high’ level traffic SSL certificate. An SSL certificate is an SSL certificate. Put a ‘low traffic certificate’ on a high traffic site or a ‘high traffic certificate’ on a low traffic site – there’s no pros and no cons in this regard.

Hope that helps answer your question and apologies for my delayed reply.

David.

“Perfect for small and personal website projects that experience low levels of traffic.”

Is there are technical reason that this certificate would only be suitable for a site with low levels of traffic? What if it was used with a high-traffic site? What might happen?