Free SAN certificates with a 3-year term

In addition to Let's Encrypt, WoSign also offers free SAN certificates for Exchange Server, for example. The advantage of WoSign: The certificates are valid for up to 3 years:

WoSign is a Chinese CA whose root certificate can be found in all common browsers and operating systems. Here is an example for Windows:

This means that WoSign certificates are trustworthy on most devices. As I was looking for a cheap certificate for my private use, I tested both Let's Encrypt and WoSign. I liked WoSign better because I don't have to replace the certificate every 3 months.

It only took a few minutes from the application to the issuing of the certificate. It is therefore highly recommended for private or small environments.

Certificates can be applied for here:

• https://buy.wosign.com/free/#ssl

Here I once described how to create a certificate request for public CAs with Exchange 2013 (also valid for Exchange 2016):

• https://www.frankysweb.de/exchange-2013-zertifikatsanforderung-fr-ffentliche-ca-erstellen/

However, I don't use the WoSign certificate directly on the Exchange server but on the Sophos UTM WAF, and there were no problems here either. Simply enter all DNS names in the CSR and then assign the virtual web servers to the names on the certificate accordingly:

The complete instructions for the Sophos WAF can be found here:

• https://www.frankysweb.de/sophos-utm-9-4-waf-und-exchange-2016/

Qualys SSL Labs also has nothing to criticize about the certificate, WoSign issues certificates with SHA256:

I'll also take another look at the Let's Encrypt clients for Windows, I'm curious to see if they work a little better now.

For all those who also want the integration of Let's Encrypt in the Sophos UTM, there is a feature request here:

• http://feature.astaro.com/forums/17359-utm-formerly-asg-feature-requests/suggestions/10409280-let-s-encrypt-integration

In my opinion, integration would be very helpful, so I have also cast 3 votes.

Finally, an important noteWoSign offers to issue the certificate even without a corresponding CSR. This may sound simple, but in fact WoSign is in possession of the private key and could theoretically use it to decrypt the communication. If you submit the CSR yourself, you avoid this risk as the private key remains on your own server.

Update 11.01.17Apple has removed StartSSL and Woosign from the trusted CAs. This means that these certificates can no longer be used with Apple devices. At Let's Encrypt there are still free certificates.