which CA is recommended?

rinomardo2 · 2018-11-05T13:11:19.000Z

so we’ve been using Symantec for our ssl certificates but as you know they’ve been turned over to DigiCert.

now we need to renew our ssl certificates, which is recommended CA? Comodo, DigiCert, GoDaddy?

of the three mentioned, i tend to go for GoDaddy since they have a mideast presence but they don’t have any email contacts for sales. plus they are also US$20 cheaper than Comodo.

what do you think? Comodo or GoDaddy?

maxsec · 2018-11-05T13:19:58.000Z

Letsencrypt- free and automate-able… why pay?

rinomardo2 · 2018-11-05T13:23:17.000Z

Martin2012:

Letsencrypt- free and automate-able… why pay?

can you install and use it for Exchange 2013? i had a look and it expects the host to be *nix to pull the certs.

maxsec · 2018-11-05T13:33:01.000Z

Media Realm – 1 Jan 18

Let's Encrypt and Microsoft Exchange - Media Realm

Find out how to automatically install and renew the free Let's Encrypt SSL Certificates for Microsoft Exchange.

Est. reading time: 3 minutes

rinomardo2 · 2018-11-05T13:46:17.000Z

Martin2012:

Let's Encrypt and Microsoft Exchange - Media Realm

when one of the requirements says " Public-facing access to IIS Server Port 80 (including public DNS records) ", does it mean to install or run the script from the CAS server? coz of OWA, my CAS server can access the Internet. so i should run the installation and renewal script from the CAS server then?

rinomardo2 · 2018-11-05T13:56:56.000Z

Martin2012:

Letsencrypt- free and automate-able… why pay?

after reading the script, i think i’ll pass on this one.

US$100 or less yearly is not a big deal for our company anyways. thanks.

jadrien · 2018-11-05T14:21:05.000Z

Personally, I would choose neither Comodo or GoDaddy. I have been using DigiCert.

SSLs do have levels and some compliance entities do care about what level of validation you have. Its not just a money grab as some like to say.

The cheapest ones are securing the legitimacy of the org name and related details literally only as far as and e-mail is sent to a mailbox and responded to.

The higher level ones also involve a deeper vetting process that confirms of the name and related details in public business databases.

Gary-D-Williams · 2018-11-05T14:36:13.000Z

If you want to pay for your certs, digicert. Personally, I’d always use lets encrypt.

dbeato · 2018-11-05T15:00:14.000Z

You can use Let’s Encrypt with Exchange, I have it running with Exchange 2016. Just need to make sure you have this when running it:

GitHub

GitHub - win-acme/win-acme: A simple ACME client for Windows (for use with...

A simple ACME client for Windows (for use with Let's Encrypt et al.) - win-acme/win-acme

Just make sure to take a look at this:

github.com/win-acme/win-acme

Improve Microsoft Exchange script and docs

opened 05:02PM - 26 Apr 18 UTC

closed 06:44PM - 27 Jan 19 UTC

nemchik

enhancement help wanted

I was having trouble getting the included scripts to work with Exchange today an…d after a few hours and many retries I was finally able to get everything working after making some adjustments to the scripts and commands. I wanted to share this information, and ask that it be considered for review and possible adjustments to the existing scripts and wiki. The first adjustment I needed to make was this https://github.com/PKISharp/win-acme/blob/634d3f4137364524b2f852fec462e097a6981043/letsencrypt-win-simple/Scripts/ImportExchange.ps1#L94 needed to be changed to: ``` FileName = $StorePath ``` Then I made a new file called `./Scripts/PSExchange.bat` containing the following: ``` powershell.exe -ExecutionPolicy Bypass -File ./Scripts/ImportExchange.ps1 %2 IIS,SMTP,IMAP,POP 1 %1 %3 ``` It is important that IIS is included in the services being set above because that makes sure that Exchange is using the new cert for MAPI and Autodiscover (which is what lets local Outlook clients connect to Exchange) and the IIS plugin alone doesn't seem to get the job done for Exchange. Also, for whatever reason I had trouble passing the services as a parameter in `--scriptparameters` but it worked fine when I included it directly in the bat file above. Also I am using `Bypass` for the `ExecutionPolicy` because `RemoteSigned` doesn't work with the included scripts since they are not signed, and `Unrestricted` would result in the bat file timing out trying to run the Powershell script for me because it was prompting to Run Once but not receiving a response. `Bypass` seems to work without issue. Lastly the command I used to run everything was this: ``` letsencrypt.exe --plugin manual --manualhost mail.example.com,autodiscover.example.com --validation selfhosting --installation iis,manual --installationsiteid 1 --script "./Scripts/PSExchange.bat" --scriptparameters "{0} {5} {2}" ``` Note that we're passing `{2}` which is the full path and filename of the pfx to the powershell script which is why the first change was necessary. Also we're not using a Central SSL store for this (I tried but had no luck getting that to work). I hope this information is helpful to some others and the things I described above make sense and could be considered for adjustments to the scripts included in win-acme.

rinomardo2 · 2018-11-06T05:09:17.000Z

Jim Peters:

Personally, I would choose neither Comodo or GoDaddy. I have been using DigiCert.

SSLs do have levels and some compliance entities do care about what level of validation you have. Its not just a money grab as some like to say.

The cheapest ones are securing the legitimacy of the org name and related details literally only as far as and e-mail is sent to a mailbox and responded to.

The higher level ones also involve a deeper vetting process that confirms of the name and related details in public business databases.

why not Comodo or GoDaddy? personal preference?

i’m just comparing (the basic only, domain validation) what i see on their websites and nothing convinces me why DigiCert should be more expensive with the rest. do we get more protection due to the higher prices?

Gary-D-Williams · 2018-11-07T14:29:20.000Z

I wouldn’t touch GoDaddy on principle. Their whole business and advertising model is shady. They build their business on being sexist, something that the industry doesn’t need.

tiffany-for-digicert · 2018-11-07T14:36:28.000Z

badbanana:

Jim Peters:

Personally, I would choose neither Comodo or GoDaddy. I have been using DigiCert.

SSLs do have levels and some compliance entities do care about what level of validation you have. Its not just a money grab as some like to say.

The cheapest ones are securing the legitimacy of the org name and related details literally only as far as and e-mail is sent to a mailbox and responded to.

The higher level ones also involve a deeper vetting process that confirms of the name and related details in public business databases.

why not Comodo or GoDaddy? personal preference?

i’m just comparing (the basic only, domain validation) what i see on their websites and nothing convinces me why DigiCert should be more expensive with the rest. do we get more protection due to the higher prices?

Hey OP! Happy to help answer any specific questions you have regarding DigiCert! There are several key advantages to using DigiCert including excellent customer support, universal compatibility, and the fastest issuance/load times (up to 8x faster than the competition) If you haven’t already looked at the details, you can do so here for more specifics about the advantages of DigiCert: Basic TLS/SSL Certificates

Feel free to message me directly if you’d like more information or if you have any questions! Good luck!

rinomardo2 · 2018-11-08T06:01:59.000Z

Tiffany for DigiCert:

Hey OP! Happy to help answer any specific questions you have regarding DigiCert! There are several key advantages to using DigiCert including excellent customer support, universal compatibility, and the fastest issuance/load times (up to 8x faster than the competition) If you haven’t already looked at the details, you can do so here for more specifics about the advantages of DigiCert: Basic TLS/SSL Certificates

Feel free to message me directly if you’d like more information or if you have any questions! Good luck!

fastest load times? first time i heard this. it’s only a cert so? can you please be more specific or provide examples. the same with universal compatibility.

Gary-D-Williams · 2018-11-08T19:56:17.000Z

Tiffany for DigiCert:

There are several key advantages to using DigiCert including excellent customer support, universal compatibility, and the fastest issuance/load times (up to 8x faster than the competition)

do what now? it’s a cert, how do load times come in to this? How does universal compatibility come in to this? That is absolutely NOT how certs work.

Tiffany for DigiCert

badbanana

@rinomardo2 @tiffany-for-digicert

tiffany-for-digicert · 2018-11-08T20:23:21.000Z

Gary D Williams:

Tiffany for DigiCert:

There are several key advantages to using DigiCert including excellent customer support, universal compatibility, and the fastest issuance/load times (up to 8x faster than the competition)

do what now? it’s a cert, how do load times come in to this? How does universal compatibility come in to this? That is absolutely NOT how certs work.

Tiffany for DigiCert

badbanana

Happy to provide more detail here! When I say load times, I should clarify to say OCSP response times. In a nutshell, OCSP response times are in real-time. OSCP requests do not require the browser to check through long lists of revoked certificates to find certificate status. Likewise, OCSP requests contain much less information than CRL requests and can therefore be processed much quicker. (Source: Understanding OCSP Times and What They Mean for You | DigiCert.com )

As far as universal compatibility, DigiCert is one of the largest certificate providers in the world, and trusted by all common browsers, mail clients, operating systems, and browsers. - though it should be noted that Certificate trust issues usually denote a problem with the certificate installation, as opposed to a problem with the certificate itself.

Hope this helps!