Extended verification certificates (EV; "actually verified") cause the browser bar to turn green. That will make people more likely to trust you.

studies has shown that people dont know what the green bar actually means: http://en.wikipedia.org/wiki/Extended_Validation_Certificate...

imho a extremely overrated (and overpriced) features, which imposes no extra security what so ever.

Carl,

You are pointing to a study that was published in 2006. This means the actual data is at least 7 years old.

Can you find a more current example?

Exactly! In fact the change to green out of the ordinary lack of it might make them think something is WRONG, not better.

These are users who also keep their browser sessions going forever and therefore session cookies never expire - thereby making what was supposed to make something more secure, exactly the opposite.

The free one also wont work with wildcard certs, and will only accept one hostname in the subjectAltName field. My domain is "grepular.com", the certificate needs to contain "secure.grepular.com" for historical reasons. This means, when I use startssl, I can't include "www.grepular.com" in the cert. Unless I pay for a cert.

Thanks for clarifying!

Will a free StartSSL certificate trigger an 'untrusted source' warning from the browser?

Also, will a free certificate be adequate for encrypting authentication data in a web API?

StartSSL is completely fine for those goals. Pretty much the only effect of an EV certificate is the green bar. (Which is easily worth $150/yr if you're doing millions in e-commerce, of course!)

By the way, I went ahead and got a free StartSSL certificate. So far it seems to work fine. Thanks again for your feedback.

Excellent - thank you!

should be ok for a web API, but for an e-commerce site, you'll likely want a recognized CA.