SSLlogic – Comodo SSL Certificates Reseller

Start Live Help Chat

LiveZilla Live Chat

Why SSLlogic.com?

Broad range of online security products
Unbeatable lowest price SSL certificates
24x7 technical and sales support
Get Free "SSL Secured Site Seal"
Exceptional service on every purchase
SSL installation available on request
Buy – Renew SSL with peace of mind

Product Spotlight

FAQ

What is Secure Sockets Layer (SSL)?

The Secure Sockets Layer protects data transferred over http using encryption enabled by a server's SSL Certificate. An SSL Certificate contains a public key and a private key. A public key is used to encrypt information and a private key is used to decipher it. When a browser points to a secured domain, an SSL handshake authenticates the server and the client and establishes an encryption method and a unique session key. They can begin a secure session that protects message privacy and message integrity.

What encryption strength do I need for my Web site?

Best security practices are to install a unique certificate on each server and choose a True 128-bit Certificate by purchasing a Server Gated Cryptography (SGC)-enabled SSL Certificate. A unique certificate keeps your private keys protected, and an SGC-enabled certificate ensures that every site visitor, no matter what browser or operating system they use, connects at the highest level of encryption their system is capable of. You need 128-bit or better encryption if you process payments, share confidential data, or collect personally identifiable information such as social security or tax ID number, mailing address, or date of birth. You need 128-bit or better encryption if your customers are concerned about the privacy of the data they send to you.

What will I need to provide in order for COMODO to verify my business identity?

COMODO must verify the existence of your business, the ownership of your domain name, and your employment status or authority to request the SSL Certificate. We may require official government documentation proving your right to do business. These may include:

If we cannot automatically authenticate your company's management responsibility for the domain name that is associated with the SSL Certificate, we will require an authorization letter from that domain's owner. This step prevents applicants from fraudulently or accidentally obtaining SSL Certificates for inappropriate domains.

Why is it important for COMODO to verify my business identity during enrollment?

To protect against fraud and phishing sites, Web visitors look for evidence of encryption and third-party authentication of the Web site’s business identity. When you request an SSL Certificate or a Managed PKI for SSL account or pre-approve your organization from within your COMODO Certificate Center Enterprise Account, COMODO verifies the existence of your business, the ownership of your domain name, and your employment status. We may require official government documentation proving your right to do business. We use the verified information to display in the address bar of high security browsers protected by Extended Validation SSL and in our COMODO Secured Seal pop-up window.

Our authentication and verification procedures are based on years of practice authenticating commercial businesses. These procedures are audited annually by KPMG using Statement of Auditing Standard 70 Type II, established by the American Institute of Certified Public Accountants. COMODO is a leading Certificate Authority, securing more than one million Web servers.

What is Extended Validation (EV) SSL?

EV SSL is advanced data encryption/decryption technology SSL certificate. A group of leading SSL Certificate Authorities (CAs) and browser vendors, approved standard practices for certificate validation and visibility called the Extended Validation (EV) SSL Guidelines. To issue an SSL Certificate that complies with the standard, a CA must adopt the extended certificate validation practices and pass an audit. When buyer visit a Web site secured with an EV SSL Certificate, high-security browsers will trigger the address bar to turn green and display the name of the organization listed in the certificate as well as the Certificate Authority. The browser and the Certificate Authority control the display, making it difficult for phishers and counterfeiters to hijack your brand and your customers.

What is a high-security browser?

Web browsers that emerged after the development of the Extended Validation (EV) standard established by the CA/Browser forum and that were developed to recognize EV SSL Certificates are considered high-security browsers. They are designed to trigger unique visual cues to indicate the presence of an EV SSL Certificate. For instance, Internet Explorer 7 shows a green address bar and displays the name of the organization listed in the certificate as well as the certificate’s security vendor. These displays make it easier for Web site visitors to quickly establish trust with the Web sites they visit. Microsoft® Internet Explorer 7 and Firefox 3 are examples of high-security browsers.

What is a Certification Authority (CA)?

When COMODO issues an SSL Certificate, it acts as a Certificate Authority (CA). COMODO digitally signs each certificate we issue. Each browser contains a list of CAs to be trusted. When the SSL handshake occurs, the browser verifies that the server certificate was issued by a trusted CA. If the CA is not trusted, a warning will appear. When high-security browsers recognize an Extended Validation SSL Certificate, they sometimes display the name of the CA as well as the name of the Certificate owner. Because COMODO is the most trusted and recognized CA on the Internet, the presence of the COMODO name can lend an additional level of trust for site visitors.

What is a Certificate Signing Request (CSR)?

The CSR is a string of text generated by your server software. The CSR is digitally encrypted code and it contains value of Server, Domain, and Organization. You provide this string of text to COMODO during the enrollment process.

Secure Sockets Layer (SSL): How It Works

Secure Sockets Layer (SSL) technology protects your Web site and makes it easy for your Web site visitors to trust you in three essential ways:

An SSL Certificate enables encryption of sensitive information during online transactions. SSL establish secure channel communication between user browser and web server. Each SSL Certificate contains unique, authenticated information about the certificate owner.

Who needs SSL Certificate?

Website having an online store or accept online orders and credit cards
Website offers a login or sign in on your site. i.e. Employee Sign in / Customer Sign in
Website process sensitive data such as address, birth date, license, or ID numbers
Website needs to comply with privacy and security requirements
Who value privacy and expect others to trust you.

How Encryption Works

We regularly use postal service facilities. Imagine sending mail through the postal system in a clear envelope. Anyone with access to it can see the data. If it looks valuable, they might take it or change it. An SSL Certificate establishes a private communication channel enabling encryption of the data during transmission. Encryption scrambles the data, essentially creating an envelope for message privacy.

Each SSL Certificate consists of a public key and a private key. The public key is used to encrypt information and the private key is used to decipher it. When a Web browser points to a secured domain, a Secure Sockets Layer handshake authenticates the server (Web site) and the client (Web browser). An encryption method is established with a unique session key and secure transmission can begin. True 128-bit SSL Certificates enable every site visitor to experience the strongest SSL encryption available to them.

How Authentication Works

Imagine receiving an envelope with no return address and a form asking for your bank account number. Every COMODO® SSL Certificate is created for a particular server in a specific domain for a verified business entity. When the SSL handshake occurs, the browser requires authentication information from the server. By clicking the closed padlock in the browser window or certain SSL trust marks (such as the COMODO Secured® Seal), the Web site visitor sees the authenticated organization name. In high-security browsers, the authenticated organization name is prominently displayed and the address bar turns green when an Extended Validation SSL Certificate is detected. If the information does not match or the certificate has expired, the browser displays an error message or warning.

Why Authentication Matters

Like a passport or a driver’s license, an SSL Certificate is issued by a trusted source, known as the Certificate Authority (CA). Many CAs simply verify the domain name and issue the certificate. COMODO verifies the existence of your business, the ownership of your domain name, and your authority to apply for the certificate, a higher standard of authentication.

COMODO Extended Validation (EV) SSL Certificates meet the highest standard in the Internet security industry for Web site authentication as required by CA/Browser Forum. EV SSL Certificates give high-security Web browsers information to clearly display a Web site’s organizational identity. The high-security Web browser’s address bar turns green and reveals the name of the organization that owns the SSL Certificate and the SSL Certificate Authority that issued it. Because COMODO is the most recognized name in online security, COMODO SSL Certificates with Extended Validation will give Web site visitors an easy and reliable way to establish trust online.

What Is Encryption?

Encryption is the process of scrambling a message so that only the intended audience has access to the information. As more people share confidential data and applications using the Internet, they have come to rely on commercially available Secure Sockets Layer (SSL) encryption.

When an SSL handshake occurs between a client and server, a level of encryption is determined by the Web server, the client browser, the client operating system, and the SSL Certificate. Low-level encryption, 40 or 56 bits, is acceptable for sites with low-value information. High-level encryption, at 128 bits, can calculate 288 times as many combinations as 40-bit encryption. That’s over a trillion times a trillion times stronger.

What Is E-Commerce Security?

E-commerce is a commercial transaction between buyer and seller that occurs online instead of in person or over the phone. The customer uses a credit card, check/debit card, purchasing card, or a check to pay for goods or services on a Web site. Secure electronic payments are spreading beyond the Internet to mobile handsets and television set-top boxes. Look for m-commerce and t-commerce next.

E-commerce also refers to electronic payment processing. Instead of going to the bank with deposits and checks or connecting over dial-up telephone lines to authorize credit cards, merchants use the Internet to connect to financial networks for payment.

What Is E-Mail Encryption?

Encryption is used to code an email so that it cannot be read or tampered with. Recipients of an encrypted email can verify the identity of the sender and know that the information contained in the message has not been intercepted or changed. Because the recipient can verify the identity of the sender, encryption also provides authentication. A digital signature is legally binding and cannot be repudiated or forged.

The sender and recipient use a key pair: a private key and a public key. The public key encrypts the message and the recipient uses the matching private key and password to decrypt it. Email encryption is used today for both business and personal reasons. The Internet is a public network and when you send information such as bank account data, passwords, social security numbers, or any kind of private data without encryption, you cannot guarantee that it will remain private unless that message is encrypted.

What Is https?

Web pages beginning with "https" instead of "http" enable secure information transmission via the protocol for secure http. Securing networks and applications is essential to secure online transactions. “Https” is one measure of security to look for when sending or sharing confidential information such as credit card numbers, private data records, or business partner data.

What Is It OWA SSL?

Outlook Web Access SSL (OWA SSL) is an enterprise solution for enabling secure, remote access to email from a Web browser. When users access email from an Exchange Server onsite they are protected by the security of the internal network, but remote users are sending and receiving email across the Internet, a public network. To prevent eavesdropping, tampering, and to provide authentication, SSL can be deployed on the Exchange Server. When users log in to view email remotely, they will use secure http or https and protect the privacy of their data.

What Is PGP Encryption?

PGP stands for "Pretty Good Privacy" and is an encryption standard created by Phil Zimmerman and first released in 1991. The protocol is used by Web browsers and email programs to encrypt data before transmission over networks. The recipient uses a private key to decrypt the data and to verify the digital signature of the sender. PGP can also be used to encrypt stored data. Originally offered as a freeware program, PGP has evolved into both commercial and open source versions.

An alternative encryption technology is Secure Sockets Layer (SSL), a protocol developed for TCP/IP transmissions. Each SSL Certificate is created for a particular Web server in a specific domain for a verified business entity. Like a passport or a driver’s license, an SSL Certificate is issued by a trusted authority. Digital IDs based on SSL can be installed within email programs and Web servers to encrypt email communications between individuals.

What Is Web Hosting Encryption?

A Web site must reside on a Web server connected to the Internet to be available for browsing, but not everyone has to set up their own Web server. In fact, most Web sites rent Web server space from Internet service providers or Web hosting companies. These companies offer a range of services to support the hosting, design, development, and promotion of your Web presence.

As you consider what your Web site might look like and what it should say, don’t forget about security. When you collect information through your Web site online, you put that information at risk unless you secure it during transmission. In fact, customers increasingly look for proof of security before they share their private data with you. If you want your visitors to trust you with their passwords, addresses, credit card numbers, and other personal information, be sure to secure your site with SSL encryption.

What Is Wildcard SSL Certificates?

A Wildcard SSL Certificate helps enable SSL encryption on multiple sub-domains using a single certificate as long as the domains are controlled by the same organization and share the same second-level domain name. For example, a Wildcard certificate issued to Company ABC using the Common Name (“*.Mydomain.com”) may be used to secure the following domains:

login.mydomain.com

payment.mydomain.com

support.mydomain.com

What is SSL technology?

SSL is an abbreviation for Secure Sockets Layer, is the standard security technology for creating an encrypted link between a web server and a browser. This link ensures that all data passed between the web server and browser remains private and integral. SSL is an industry standard and is used by millions of websites in the protection of their online transactions with their customers. In order to be able to generate an SSL link, a web server requires an SSL Certificate. Instant SSL is such a Certificate, and when installed, can be used to create secure links to protect transactions, passwords, personal details, etc.

Why does an Instant SSL Certificate cost considerably less compared to other CAs?

Instant SSL has direct access to the IdAuthority, the largest commercial directory on the web. Instant SSL can therefore expediate the validation of an application. This efficient and highly effective validation method ensures we can issue a Certificate at a greatly reduced cost as reflected through our guaranteed lowest price in the industry as well as maintain a level of validation far superior to the methods employed by other SSL providers. In particular, the validation process employed to issue an InstantSSL, Instant SSL Pro or PremiumSSL Certificate is considerably more than just a domain name ownership check - we firmly believe this method alone to be insufficient to maintain the level of integrity in SSL that consumers have come to expect.

Will Instant SSL Certificates be compatible with my customer's browsers?

In order for your customer's browser to seamlessly use an Instant SSL Certificate, they must trust our 'Root Certificate'. Our Root is trusted by over 99.3% of all current browsers, comprising all Internet Explorer 5.00 and above, Netscape 4x and above and AOL 5 and above and comes pre-installed with all Windows 98SE, Windows ME, Windows 2000 and Windows XP operating systems. This browser compatibility makes Instant SSL as trusted as COMODO.

What does the Warranty actually mean?

We believe it is important to protect the end user. If we were to mis-issue a certificate to a fraudulent site, that fraudulent site has an SSL link with an end user and as a result of this the end user loses money the end user had what they thought was a "trusted session". COMODO should never have provided the fraudster with the ability to engineer this situation we therefore have insurance to pay the end user for any losses that they may incur. Why would we do this?

We value the end customer
We believe the insurance provides greater peace of mind and therefore allows the merchant to sell more products
Most importantly, we value our validation techniques (delivered through www.idauthority.com)

We pre-validate customers and provide validation that is far higher than the majority of other SSL providers. Some CA's have weak validation so they do not offer insurance! We also offer high validation, but not at the compromise of speed. You can still obtain SSL instantly.

I want an increased/extended Warranty on my Instant SSL Certificate - How can I get this?

If you require an increased warranty on your SSL Certificate, choose from the Instant SSL Pro or PremiumSSL Certificates option. This provides a greatly increased warranty of $100,000 and $250,000 respectively.

How long does it take to process my application?

Provided we have sufficient validation information available through the IdAuthority (as described in our CPS), your InstantSSL, Instant SSL Pro or PremiumSSL can be issued in only minutes. If additional verification processes must be used to validate your application, the issuance process may take slightly longer. In such cases we guarantee that the Certificate is issued within 2 working days.

Why does an Instant SSL Certificate cost considerably less than other Certification Authorities?

Instant SSL has direct access to the IdAuthority, the largest commercial directory on the web. Instant SSL can therefore expedite the validation of an application. This efficient and highly effective validation method ensures we can issue a Certificate at a greatly reduced cost as reflected through our guaranteed lowest price in the industry as well as maintain a level of validation far superior to the methods employed by other SSL providers. In particular, the validation process employed to issue an InstantSSL, Instant SSL Pro or PremiumSSL Certificate is considerably more than just a domain name ownership check - we firmly believe this method alone to be insufficient to maintain the level of integrity in SSL that consumers have come to expect.

Which webserver, browser and version of the SSL protocol is Instant SSL compatible with?

Instant SSL is compatible with any browsers and webservers using SSL version 3 - the de facto SSL implementation. SSL version 1 and version 2 have been superseded by version 3 for a number of years, mainly due to the inherent security flaws found in these old versions. All web browsers developed after Internet Explorer 3 and Netscape 3 use SSL version 3 (however still support older SSL protocol versions). If your webserver is only capable of supporting versions 1 and 2 of the SSL protocol we strongly recommend you contact your webserver software vendor for an update - these protocols are flawed. For more details on why SSL version 2 is no longer used can be found here:
http://www.eucybervote.org/Reports/MSI-WP2-D7V1-V1.0-02.htm

Do COMODO SSL certificates only support 128 bit encryption?

No, they support the key size as determined by the web server or browser, if the web server or browser can only negotiate 40 or 56 bit then this is session that is established

What is strong encryption and how does Instant SSL provide Secure SSL Authentication?

Strong SSL Encryption is the process of changing data into a form that can be read only by the intended receiver. To decipher the message, the receiver of the encrypted data must have the proper decryption key. In traditional encryption schemes, the sender and the receiver use the same key to encrypt and decrypt data.

128 bit encryption is for internet security and network security with secure SSL authentication. Instant SSL certificates provide a strong SSL encryption.

What is an EV (Extended Validation) SSL Certificate?

Extended Validation (EV) SSL Certificates are the next generation SSL Certificate because they help protect against phishing attacks. They work with web browsers (e.g. Internet Explorer 7.0, Firefox 3.0 and Opera 9.5) so that visitors to Websites with an EV SSL Certificate will see a "Green Address Bar". EV SSL Certificates represent a new industry standard for e-merchant identity verification developed by the CA/B Forum.

What are the benefits of EV SSL Certificates to Web site owners?

An EV SSL Certificate helps you gain competitive advantage by increasing trust in your Web site that translates into higher conversion rates and increased revenue.

What is EV AUTO-Enhancer™ - Automatic EV Deployment and Maintenance Technology?

COMODO EV AUTO-Enhancer™ is a patent-pending technology designed to enable Microsoft® Windows XP users to see the "Green Address Bar" indicator in Microsoft® Internet Explorer 7. Unlike XP compatibility solutions offered by other Certification Authorities, EV AUTO-Enhancer™ provides this capability simply by installing a small program on your web server at the time you install your EV SSL Certificate. It installs quickly and easily, and provides "Green Address Bar" functionality to XP users beyond that of other solutions, which, for example, require site visitors to have JavaScript enabled - ours doesn't. Only COMODO's approach is deployed solely by IT staff, and does not require the involvement of web developers to setup or maintain the solution.

How does EV AUTO-Enhancer™ work?

With COMODO's unique, patent-pending EV AUTO-Enhancer™ technology, your system administrator need only install a single file on your Web server to make EV SSL Certificates display the "Green Address Bar" indicator in Microsoft® Internet Explorer 7 for customers who use Microsoft® Windows XP. This saves your web design team days of work in making your EV SSL Certificate backward compatible with Microsoft® Windows XP.

Normally, Web servers are configured to send only a single certificate chain during SSL/TLS handshakes. However, a simple modification to the "standard" configuration of a Web server would cause the new Root Certificate to be sent during SSL/TLS handshakes in addition to the "legacy certificate chain". This would cause the new Root Certificate to be automatically downloaded and installed from the Automatic Root Update facility and the EV SSL Certificate "Green Address Bar" would be seen immediately. COMODO's EV AUTO-Enhancer™ technology returns the EV SSL Certificate root in the handshake from your Web server. In combination with a change of the issuance date of the cross-certificate, this will force Microsoft® Windows XP and Vista to pull the root into the certificate store.

Is EV AUTO-Enhancer™ compatible with all types of Web server?

There are currently versions available for Apache and Microsoft® IIS Web servers. Others may be supported in the future. If you are using a web server other than Apache or Microsoft® IIS, you should deploy COMODO's EV Enhancer™, described below.

What is EV Enhancer™?
COMODO's EV Enhancer™ enables the new "Green Address Bar" browser indicator for EV SSL Certificates to be backward compatible with Microsoft® Internet Explorer 7 on Windows™ XP by installing a trusted COMODO Root Certificate. It should be used by companies deploying EV SSL Certificates on web servers other than Apache or Microsoft® IIS. (If you are using Apache or Microsoft® IIS we recommend you use COMODO's EV AUTO-Enhancer™ described at the top of this page.

How does EV Enhancer™ work?

In order for the "Green Address Bar' to be displayed for a secure website in Microsoft® Internet Explorer 7, the relevant Root Certificate must be present in the client's Trusted Root Certificate store and it must also have an EV Policy Object Identification (OID) associated with it. In Windows Vista, EV Policy OIDs are assigned automatically via the Automatic Root Update facility. However in Windows XP (the dominant Operating System in the market today), the Automatic Root Update facility is unable to assign EV Policy OIDs to "legacy" Root Certificates that are already present in the Microsoft Root Certificate Program. This behavior forces all Certificate Authorities to embed a new Root Certificate in the Microsoft Root Certificate Program that will have the applicable EV Policy OID assigned to it. The difficulty of installing the new root certificate on Windows XP is that new Root Certificates are distributed from Windows Update. Every week, Windows downloads a signed list of all roots in the root program. When Windows validates a certificate, Windows XP shows the following behavior:

Windows XP first tries to build a chain using certificates from the TLS/SSL protocol, in addition to the local certificate stores;

If Windows is unable to find a chain up to a self-signed certificate, Windows tries to download additional certificates using information in the certificate;

If a chain up to a self-signed certificate can not be found, Windows tries to find a match in the signed list of roots retrieved from Windows Update. If a match is found, the Root Certificate is then downloaded and installed silently.

In most cases Windows XP will find a legacy Root Certificate (for COMODO this is UTN and AddTrust), which will mean that at least one trusted certificate chain will be found during phase one and no new EV root will be installed. Therefore, it is not possible to use the Root Update Mechanism provided by Microsoft. To solve this problem, the website must trigger an TLS / SSL connection to a HTTPS URL that points to a certificate that is not cross signed and does not refer to a legacy Root and returns only the End Entity and Issuing CA certificates. This method will force Windows XP to validate a certificate chain where it must download the new EV root.

The figure below shows the process in more detail:

Consumer PC visits https://www.myEVsite.com and the web server returns the chain including the cross certificate to the user during TLS/SSL negotiation;

The website contains an EV Enhancer™ script to https://ev-enhancer.COMODO.com;

The user makes a second TLS/SSL negotiation with ev.cadomain.com which returns a different End Entity certificate and no cross signed certificate;

Windows XP validates End Entity B and is unable to build a chain to a known self-signed certificate.

Based on the above scenario, the user will not see the "Green Address Bar" in Internet Explorer 7 until the second time he visits the site. This can be improved to be a first time visit if the home page of the website is not a HTTPS URL and the EV Enhancer™ technology is activated from a page leading up to the HTTPS EV SSL trusted page. The EV Enhancer™ downloads and installs the EV Root from Windows Update before the user enters the SSL connection. This requires your website administrator to add a link to an HTTPS "beacon" site on each entry page of your website.

What is SGC?

SGC is Server Gated Cryptography. It provides the ability for a certificate to 'up-rate' older browsers that are only capable of weak, 40-bit encryption to ultra-secure 128/256-bit encryption without the need to upgrade. It was introduced at a time when stringent United States encryption export laws would only allow browsers to encrypt 40-bit levels. Understandably, there are still millions of users that still use these older browsers. Websites wishing to offer the highest level of trust and 256-bit encrypted transactions to the widest possible customer base should consider EV SGC SSL Certificates.

Will I be able to upgrade my existing COMODO High Assurance SSL Certificate to get the "Green Address Bar" in my customer's Web browser?

Sure. COMODO can offer you a quick migration path from your existing High Assurance SSL Certificate to an EV SSL Certificate. After your reservation, you may have to submit additional documentation. The COMODO sales team will assist you throughout the process. So submit your contact information and we will contact you shortly. Alternatively, call US toll free: 1 888 266 6361 or from outside of the US: 1 703.581.6361.

Is my existing High Assurance SSL Certificate still sufficient for protecting online transactions?

All COMODO SSL Certificates will continue to provide security encryption to ensure that data being transferred between your Web site and your customer's Web browser can not be stolen. In addition your current High Assurance SSL Certificate will continue to provide identity assurance for your Web site.

Validation Levels

All Extended Validation Certificates undergo a new validation process that has been established by the industry group CA/B Forum. This vetting process ensures rigorous validation of both domain name and company details before issuance, in order to provide the highest levels of security and trust for your customers.

The EV SSL Certificate Validation Process

The goal of the validation process is to ensure that consumers have a way to authenticate legitimate sites from phishing sites. The increased trust and consumer protection offered by EV certificates necessarily involves a more rigorous validation process. This new procedure has been established by the industry group, CA/B Forum.

Some basic requirements that a business needs to conform to obtain an EV SSL certificate include (but are not limited to):

Legal status as a company created by government filing
Registration number of incorporation
Place of business is in same jurisdiction (e.g. country) as place of business registration
Organization name
Business name
Full address and main phone number of place of business

Not sure if your Business is incorporated? Click here to find out

I am not a company, can I apply for a Certificate?

Yes, anyone wishing to provide a confidential and secure link between server and customer's browser can apply for a certificate.

When I generate a CSR what do I put in the Common Name field?

The Common Name field contains the domain or server name. Do not include http:// or before the name or any subfolders indicated by the / after the domain name

I ordered my certificate but chose the wrong type of web server - how do I know if my SSL Certificate and Server are compatible?

The web server details are for our records and support purposes only. The certificates are the same format irrelevant of the web server chosen.

Can I apply for SSL Certificates for sub-domains?

Yes, but it can be simpler and more cost effective to open an account as an Enterprise Public Key Infrastructure Manager (EPKI Manager). For more information please contact sales@COMODO.com.

It may also be more cost effective to use a Wildcard certificate which protects all sub-domains below the primary named domain. For more information please contact sales@COMODO.com

Where do I upgrade to the latest COMODO SSL Root Certificate?

You may directly install the SSL certificates by clicking on the certificate files below and you will be prompted to save these into your root certificate store. At each stage of the installation, merely select the default option.

TrustedCertificateServices

AAACertificateServices

SecureCertificateServices

Code Signing - General FAQ's

Who needs a Code Signing ID?

Any publisher who plans to distribute code or content over the Internet or over corporate extranets risks corruption and tampering

How does the COMODO Code Signing solution work?

COMODO Code Signing uses authenticated digital signatures to assure the publisher details and content integrity of downloadable code.

Is the COMODO Code Signing solution the right product for me?

COMODO Code Signing is essential if you wish to protect your reputation as an authenticated code publisher.

Does COMODO certify the content of my code?

No. We certify that the software really comes from the publisher who signed it. We also certify that the software has not been altered or corrupted.

Is COMODO Code Signing the right product for my business?

A COMODO Code Signing certificate is strongly recommended for any publisher intending to distribute code or content over the Internet or over corporate extranets. Customers are aware of the dangers involved and are far more trusting of a signed download.

A COMODO Code Signing certificate is an effective way to distribute authentic software over the Internet. It is a best-of-breed product that offers full protection, ease of use and flexible.

How long can I use my developer certificate?

Code signing certificates are valid for one or two years depending on which life cycle you choose when you purchase the certificate.

Time Stamping Server - Location and usage

In order to sign your code, you pass the code which you want to authenticate through a hashing algorithm and then use your private key to sign the hash, which results in a digital signature. You then build a signature block, which contains the digital signature and the code-signing certificate. Tools like Authenticode let you time stamp the signature block based on the current date and time that a time stamping service provider, such as COMODO, provides. Finally, you bind the time stamped signature block to the original software. Now you can publish the signed software on your Web site for download.

As part of this process you will need to know the URL of COMODO's time stamping server, which is http://timestamp.comodoca.com/authenticode.

Is time stamped code valid after a Code Signing Certificate expires?

Time stamping ensures that code will not expire when certificate expires. If your code is time stamped the digital signature is valid even though the certificate has expired. A new certificate is only necessary if you want to sign additional code. If you did not use the time stamping option during the signing, you must re-sign your code and re-send it out to your customers.

Which utility is used to verify whether the file has been time stamped?

Use the chktrust.exe utility included with the Authenticode SDK tools to verify whether the file has been time stamped. The date and time will be displayed when the file has been time stamped. "Unknown date and time" will appear when the file has NOT been time stamped.

Do code signing certificates last longer than 1 year?

Yes. It is now possible to request a 2-year code signing certificate.

Is there a limit to the amount of applications allowed to be signed with a Code Signing Certificate?

COMODO does not limit you to any specific number. You can sign as many applications with a Code Signing Certificate as you wish, provided that the applications are going to be used for and distributed by the Organization that owns the certificate.

What settings should be enabled to allow a user to receive the certificate pop-up?

In order to receive the Certificate pop-up when the file is downloaded, you will need to enable a setting in Internet Explorer.

The setting can be found under: Tools > Internet Options > Advanced > Scroll to the bottom of the list to 'Security'

Make sure that the following option is checked: "Check for signatures on downloaded programs".

What type of assurance a customer obtains when downloading software signed with Authenticode?

When customer downloads software signed with Authenticode they can be assured of:

Content Source: The software really comes from the publisher who signed it.

Content Integrity: The software has not been altered or corrupted since it was signed.

How do I ensure that both I and my customers have the latest Microsoft roots in my certificate store?

For Windows XP, everything is Automatic, meaning well over 200 Million customers will automatically have access to all the latest certificates. For older versions of the Windows operating system, it is highly recommended that the latest root update is installed.Good security policy dictates that your root certificate store should have the most current root certificate references from all trusted certification authorities, thereby providing the widest capability to recognize trusted content. Install the latest Microsoft root certificate patch here:- Root Update

Code Signing - Technical FAQ's

What does Authenticode mean?

Authenticode is currently used to sign 32-bit .exe files (PE files), .cab files, .ocx files, and .class files. In particular, if you are distributing active content such as ActiveX controls for use with such Microsoft end user applications as Internet Explorer, Exchange, Outlook, or Outlook Express, you will want to sign code using Authenticode.

What is a Digital ID?

A Digital ID also known as a digital certificate is a form of electronic credentials for the Internet. A Digital ID is issued by a trusted third party to establish the identity of the ID holder. The third party who issues certificates is known as a Certification Authority (CA). Digital ID technology is based on the theory of public key cryptography. In public key cryptography systems, every entity has two complementary keys, a public key and private key, which function only when they are held together. The purpose of a Digital ID is to reliably link a public/private key pair with its owner. When a CA issues Digital IDs, it verifies that the owner is not claiming a false identity.

What about time stamping?

Since key pairs are based on mathematical relationships that can be cracked with a great deal of time and effort, it is a well-established security principle that digital certificates should expire. Your Digital ID will expire one year after it is issued. However, most software is intended to have a lifetime of longer than one year. To avoid having to resign software every time your certificate expires, a time stamping service is introduced. Now, when you sign code, a hash of your code will be sent to Certification authority to be time stamped. This means that you will not need to worry about resigning code when your Digital ID expires. Microsoft Authenticode allows you to time stamp your signed code so that signatures will not expire when your certificate does.

Time Stamping Server - Location and usage

In order to sign your code, you pass the code which you want to authenticate through a hashing algorithm and then use your private key to sign the hash, which results in a digital signature. You then build a signature block, which contains the digital signature and the code-signing certificate. Tools like Authenticode let you time stamp the signature block based on the current date and time that a time stamping service provider, such as COMODO, provides. Finally, you bind the time stamped signature block to the original software. Now you can publish the signed software on your Web site for download.

As part of this process, you will need to know the URL of COMODO's time stamping server, which is http://timestamp.comodoca.com/authenticode.

What will happen if an end user encounters a unsigned component distributed via the Internet?

If an end user of one of these applications encounters an unsigned component distributed via the Internet, the following will occur:

If the application's security settings are set on "High," the client application will not permit the unsigned code to load.

If the application's security settings are set on "Medium," the client application will display a warning like this screen:
SSL Logic

What will happen if an end user encounters a signed component distributed via the Internet?

If a user encounters a signed applet or other code, the client application will display a screen like the following:
SSL Logic

Who issues the digital certificates to applicants?

Certification Authorities are organizations that issue digital certificates to applicants whose identity they are willing to vouch for. Each certificate is linked to the certificate of the CA that signed it.

List the responsibilities of this Certification Authority

As the Internet's leading Certification Authority, COMODO has the following responsibilities:

Publishing the criteria for granting, revoking, and managing certificates.
Granting certificates to applicants who meet the published criteria.
Managing certificates (for example, enrolling, renewing, and revoking them).
Storing COMODO's root keys in an exceptionally secure manner.
Verifying evidence submitted by applicants.
Providing tools for enrollment.
Accepting the liability associated with these responsibilities.
Time stamping digital signatures.
What is the six step process of Signing Code?
Make sure that you are running the correct versions of all tools
Apply for a Code Signing ID for Authenticode from COMODO
Pick up your Digital ID
Prepare your Files to be Signed
Sign your files
Test your signature

How do I ensure that both I and my customers have the latest Microsoft roots in my certificate store?

For Windows XP and Vista, everything is Automatic, meaning well over 200 Million customers will automatically have access to all the latest certificates. For older versions of the Windows operating system, it is highly recommended that the latest root update is installed. Good security policy dictates that your root certificate store should have the most current root certificate references from all trusted certification authorities, thereby providing the widest capability to recognize trusted content. Install the latest Microsoft root certificate patch here:-

Root Update
Trusted Certificate Services
COMODO Code Signing CA

We want our signed files to be time stamped. Could please provide me with the URL of the time stamping server?

The COMODO time stamping server can be found at: http://timestamp.comodoca.com/authenticode

WHY SSL LOGIC WITH COMODO

We provide these certificates, but we inform the customer about its assurance level, our competitors don't necessarily do that and they pass it as if they are as good as highly validated certificates. This allows us to educate the buyer of the certificates. If the buyer is tempted to opt for a "quick cert" because they don't know any better, we are hoping to grab their attention so that we can inform them about the differences.

2)These low assurance certs don't have any "organisation/end entity validation". Which means you are on a site but you can't be sure whose site it is really. COMODO, unlike our competitors in the market place provide a free means of providing Identity assurance (www.idauthority.com) . This way, even though the low assurance ssl they get has no identity assurance, but we don't let our customer stay unprotected with no identity assurance and provide them a free identity assurance! This way, at least they will have both security and identity assurance. Again something our competitors don't do

3)Responsible people should make as much money as possible, because they do responsible things with it: as you can see above, even though we charge for this low assurance ssl service, we do it so that we can divert the unaware customers from our competitor's hands and educate/inform the customers and arm them with the right tools so that they are running their businesses with their users's trust fully in place!

How to generate CSR Key?

Click Here

How to install SSL Certificate?

Click Here