Can I use my own SSL certificate?
First and foremost…
You don’t need to purchase a cert to use FoxyCart. The standard method is to use
*.foxycart.com . We can offer this for free because wildcard SSL certs exists. If you don’t want the
.foxycart.com as part of your checkout’s URL, we allow you to send a subdomain of yours to our servers and we will host your checkout at
secure.example.com (or whatever you’d like).
Can i use my own SSL certificate? I can find one cheaper.
The short answer is “we don’t recommend it',” but please read on for the “why.”
We currently charge $100 year for an SSL certificate. For that price, you only need place the order, approve the certificate, and set up a DNS entry. Everything else is handled by FoxyCart — generating a secure private key, sending the CSR to the vendor, collecting the signed certificate, and installing it securely to our application servers. While it’s true that there are certificates for cheaper, most will require significantly more time to set up and install, and all will require technical knowledge of SSL.
Additionally, best security practices require using High Assurance certificates. Lower-cost SSL certificates use something called "domain validation," which does not provide a strong guarantee of the site's identity. These low-cost certificates have been used for malicious purposes and phishing attacks. Read more about this in this article by DigiCert.
All of our certificates are High Assurance (HA) and provide strong promises of your store's identity and the identity of the FoxyCart servers. That extra assurance comes at a premium, and it is difficult to find HA certificates in the ~$100 range.
Certificates also require a unique IP address per certificate (which has a monthly cost for us), as well as: additional DNS records and queries, server configuration, failover handling and monitoring, additional web application firewall monitoring and overhead, and more.
OK, still want to bring your own certificate? Don't worry, we do allow it — but with one caveat.
Because you are buying not only the SSL certificate, but the management and maintenance that goes along with it, we charge $200/year for bringing your own SSL certificate. Unknown SSL vendors add time and complexity, and it is most expedient and secure for us to use our known & trusted SSL vendor, with whom we have a established long-term contract.
If you have advanced requirements with regard to the SSL certificate your FoxyCart store — for example, if you need an Extended Validation (EV) certificate or wildcard (e.g., *.yourdomain.com) certificate — please contact us. We handle those situations under our our $200/year "custom SSL" plan, and there are good business justifications for those types of certificates. We are happy to work with you to meet your requirements, but if your goal is to save a few dollars over the coarse of the year then providing your own certificate wouldn’t help.
If you have any further questions, we're happy to answer them! Just drop an email to firstname.lastname@example.org