The Foxy forums are on the move!

We're in the process of moving our forums over to a new system, and so these forums are now read-only.
If you have a question about your store in the meantime, please don't hesitate to reach out to us via email.

SSL

VanceoneVanceone Member
in Help edited November 2008
Okay, I have a couple of questions. How, exactly, does security work? I know you have the secure option, but that seems to require purchasing an SSL cert through you guys, am I correct?

I mean, my host will give me a cert cheaper than you guys will. Plus, I don't think they want the articles of incorporation etc. Since we are just starting up, we have yet to draft all of that.

But the remote hosting option is the only way to kill having "foxycart" in my URL, correct?

Second, we have two related sites, but they will be different with different URLs. Will I need seperate certs for them? One will be mostly a subscription based site, and the other will sell downloads. Will I need seperate accounts for them as well?
Comments
  • brettbrett FoxyCart Team
    SSL:
    You don't need to purchase a cert to use FoxyCart. The standard method is to use *.foxycart.com. We can offer this for free because wildcard SSL certs exists. We also allow you to send a subdomain of yours to our servers and we will host your checkout at sub.example.tld (or whatever you'd like).

    We currently charge $90/yr for that, and believe it or not we actually make about $0 on that. Yes, we could get certs cheaper, and we're exploring options, but we have some limiting factors. On the other hand, you can get certs for WAY more than $90/yr, so it's not entirely unreasonable.

    Something else to keep in mind is that an SSL cert requires a unique IP, which generally cost between $0.50 and $1.00, depending on the host. So out of that $90/yr, a solid chunk goes to the IP. The bulk of it goes to the cost of the cert, and there's a little left over for the actual time involved in setting it up (which, depending on the user/domain, can be time consuming).

    The only way to get around the company background check (which Comodo (our current SSL provider) performs) is to go with a RapidSSL type cert, which doesn't do any checks at all. Those certs typically don't provide any sort of trust seal, which can be extremely useful, particularly if you're selling something. When we started doing this we picked the options that would work for the majority of our users. The Comodo certs are reasonably priced, and their trust seals are (in our opinion) the best available for the money. We've been looking at other providers that would allow us to offer multiple different options for certs, including very low cost certs, but because we need to automated things to keep our costs down it's kind of thinned out our options for providers. Very few providers offer a solid API, and without an API we're stuck doing things manually, which takes us more time and costs you more money.

    (As an aside, we've also discussed the possibility of allowing the store admin to enter their own cert. This is definitely a more involved solution, and we think it'd create more problems than it'd solve, but it's technically possible.)

    ============
    Hosting Two Sites:
    You could have two sites send to the same FoxyCart store URL, no problem. So example-a.tld and example-b.tld could both send to example.foxycart.com (or secure.example.tld), but if you want two separate FoxyCart stores at two separate domains, then that's two separate stores. (And if you want different custom domains for each, we obviously need one cert for each domain.)

    We do have some upcoming functionality, however, that might be interesting. Check out the "template sets" request on http://requests.foxycart.com/
    If you need different themes/languages/templates for a single store, vote for that. Each additional template set will likely cost a little extra, but it will be an easier option than having multiple stores.

    All that make sense?
  • Yes, it all makes sense. I'd just seen a new integration cart for FoxyCart that said we could supply our own SSL Certificates. Since my host is cheaper, I was just asking. Kinda smarts to have to pay for two stores, though. Ah well.
  • brettbrett FoxyCart Team
    Yeah, not much you can do about certs for two stores (other than just using one store, possibly with the "template sets" functionality when it arrives). There are new certs that can actually be approved for multiple domains, but they're _really_ expensive, and the way you go about getting the certs wouldn't work at all for how FoxyCart works.
Sign In or Register to comment.