I am helping a non-profit that has a very low budget and I want to be helpful without causing long-term ramifications (of which I am currently ignorant of). Thanks for any help, this stuff is confusing and I am new to it!
I highly recommend Comodo bought from NameCheap: https://www.namecheap.com/security/ssl-certificates/comodo.a...
Another heartbleed type incident could happen in the near future (lots of eyes on that codebase now) and their strict policy will leave you choosing between coughing up $35 per certificate or leaving your site vulnerable.
There has even been a large amount of discussion regarding removing them from the trusted list of certificate authorities because most of their users can't afford to revoke certificates and have no choice but to leave their sites vulnerable.
That said, I think the bad press StartSSL is getting is mostly undeserved. You can either choose a free cert with the outside chance you'll want to pay to revoke it, or just automatically pay up front every term. Probabilistically, they still have the cheapest option. And are site admins who can't/won't pay $35 really that likely to have a very secure server anyhow? That means they would have never bought SSL anyhow without StartSSL.
I believe the exact quote during the Heartbleed incident was, "Dead serious." https://twitter.com/startssl/status/453631038883758080
Since I don't have experience with them I am looking for some level of assurance that they are a legitimate service. In my opinion it is difficult to gain that assurance just from their website.
In terms of "credibility", the issue comes down to how many browsers include their root cert by default. As far as I know, IE, Firefox, and Chrome include it meaning that it will be trusted by default.
The way they make money is selling other types of services such as wildcard and "green bar" certs. I think the folks running it want to see a wider use of SSL, and see providing free host-based certs as a good way to accomplish that goal. Bear mind, there zero cost to signing a cert ...
That said, why does it matter if they're "credible"? Their certs are accepted by pretty much every browser, OS and library, and they have a long track record as a CA.
Regardless, as a business I have had business dealings with, let me assure you they are a "legitimate service".
