The certificates are mostly about PR. Most of the certificate companies don't do any checking beyond making sure the check clears. It's mostly all about convincing your customers that it's okay to enter their numbers into a box. The problem is that even if your credit card numbers can't be snooped on the way, there is still the risk that you're dealing with an illegitimate business. There are many such businesses on the internet. They pay for some cheap certificate so that your grandmother gets the pleasing padlock icon when she enters her credit card number, and then from there they are free to abuse it.

The biggest problem of all is that the public doesn't understand exactly what the padlock icon means. They believe it means that they should absolutely trust the site they are on, but they don't realize that it only means their information won't be snooped on the way. In terms of protecting against abuses once the information gets to the destination, certificates are not effective. People need to use the old fashioned methods of asking around to see if people have had problems with a certain place in the past.

Short answer, a certificate is a certificate is a certificate. The thing they want you to pay for is the estimated "public trust" in the company you got your certificate from. Unfortunately, users are probably not savvy enough to discern between certificates from any of the companies you listed. For the most part, the only people who know anything about certificates are the people who buy them or sell them.
Source(s):
http://www.schneier.com/paper-pki-ft.txt

Permalink | Report