I’m curious what the benefits are of paying for SSL certificates vs using a free provider such as letsencrypt.

What exactly are you trusting a cert provider with and what are the security implications? What attack vectors do you open yourself up to when trusting a certificate authority with your websites’ certificates?

In what way could it benefit security and/or privacy to utilize a paid service?

And finally, which paid SSL providers are considered trustworthy?

I know Digicert is a big player, but their prices are insane. Comodo seems like a good affordable option, but is it a trustworthy company?

  • Nougat
    link
    fedilink
    42 months ago

    LetsEncrypt is legit. A downside is that the certs expire after 90 days. However, that also carries an upside in that it limits the damage in case a certificate is compromised. There are procedures by which you can automatically renew/request (I forget whether they allow renewing an existing cert or require a brand new one) LE certs and apply them to your application, but that can be fiddly to configure.

    If you’re not comfortable with configuring automatic certificate cycling, a long-term paid cert would be more appropriate.

    • r00ty
      link
      fedilink
      12 months ago

      It makes sense that they issue short certificates, though. The sole verification is that you own the domain. If you sell/let the domain lapse and someone else takes it over, there’s only a limited time you would hold a valid certificate for it.

    • umami_wasabi
      link
      fedilink
      English
      -2
      edit-2
      2 months ago

      I didn’t say it isn’t legit nor I distrust automation, but I would like to see anyone operating an online shop paid for a cert to show they are honest and won’t diappear in thin air not delivering. Am I going to get back what I paid, properly not, but a basic DV cert isn’t expensive either for a business.

      • Max-P
        link
        fedilink
        English
        9
        edit-2
        2 months ago

        LetsEncrypt certs are DV certs. That a put a TXT record for LetsEncrypt vs a TXT record for a paid DigiCert makes no difference whatsoever.

        I just checked and Shopify uses a LetsEncrypt cert, so that’s a big one that uses the plebian certs.

      • Nougat
        link
        fedilink
        42 months ago

        The difference between $0 and $50 isn’t really relevant.

        • umami_wasabi
          link
          fedilink
          English
          -42 months ago

          Then I don’t see any problem for them just put down $50 more.

          • Nougat
            link
            fedilink
            82 months ago

            Bad actors can afford $50 the same as good ones.

      • @[email protected]
        link
        fedilink
        English
        12 months ago

        Would you accept a certificate issued by AWS (Amazon)? Or GCP (Google)? Or azure (Microsoft)? Do you visit websites behind cloudflare with CF issued certs? Because all 4 of those certificates are free. There is no identity validation for signing up for any of them really past having access to some payment form (and I don’t even think all of them do even that). And you could argue between those 4 companies it’s about 80-90% of the traffic on the internet these days.

        Paid vs free is not a reliable comparison for trust. If anything, non-automated processes where a random engineer just gets the new cert and then hopefully remembers to delete it has a number of risk factors that doesn’t exist with LE (or other ACME supporting providers).