I’m curious what the benefits are of paying for SSL certificates vs using a free provider such as letsencrypt.

What exactly are you trusting a cert provider with and what are the security implications? What attack vectors do you open yourself up to when trusting a certificate authority with your websites’ certificates?

In what way could it benefit security and/or privacy to utilize a paid service?

And finally, which paid SSL providers are considered trustworthy?

I know Digicert is a big player, but their prices are insane. Comodo seems like a good affordable option, but is it a trustworthy company?

  • @WIPocket
    link
    English
    82 months ago

    There are more reasons, as LetsEncrypt might be more restrictive on what you can get (for example, you cant get a certificate for an IP address from them). But, as 99.99% of usecases do not require anything like that, go with letsencrypt until you know of a reason not to.

    • @[email protected]
      link
      fedilink
      English
      12 months ago

      No proper CA should give out a certificate for an IP, that’s a no go by the common rules.

      • @WIPocket
        link
        English
        22 months ago

        I see why automatically giving them out (like in ACME) would be a bad idea, but other than that, why not? Even https://1.1.1.1 has a DigiCert cert.