I’m curious what the benefits are of paying for SSL certificates vs using a free provider such as letsencrypt.
What exactly are you trusting a cert provider with and what are the security implications? What attack vectors do you open yourself up to when trusting a certificate authority with your websites’ certificates?
In what way could it benefit security and/or privacy to utilize a paid service?
And finally, which paid SSL providers are considered trustworthy?
I know Digicert is a big player, but their prices are insane. Comodo seems like a good affordable option, but is it a trustworthy company?
I’ve used Lets Encrypt for years and years, in fact it’s been at least 6?. LE with the encryptbot?, automate the entire process, and then completely forget about it until someone posts on Lemmy asking about it.
It’s been long enough I’ve forgotten the proper names of the software and I would have to go back through my notes to recreate it.
The point of paid SSL at this stage in the game are the higher tiers of verification. Instead of just verifying that you own the domain, you can verify that you are who you say you are. These are called Extended Validation and Organizational Validation certificates. This has historically been desirable by businesses. It used to be that these higher tier certs would not only give you a lock icon in the address bar of a web browser, but also a little blurb confirming your organization is legit. Not sure if this is still the case though. You will see the extended validation when you check the sites certificate though for sure.
As far as encryption and security, there’s no difference. Also side note, the Comodo brand still technically exists but it was bought by Sectigo like 7 years ago.
Let’s encrypt, and any other ACME based certificate of authorities will let anyone without identity verification create a SSL cert that will work in any browser. This creates trust issues with certain clients browsing web. For example my work (50k+ employees) uses Zscaler to evaluate if a website is safe and it 100% will down-votes any site that uses let’s encrypt due to the lack of transparency. Zscaler will eventually block that website from employees if the score falls too low. Having an SSL cert that you pay for gives cyber security, firms - rightly or wrongly - an additional level of confidence that your identity has been verified.
Full disclosure: I use let’s encrypt on all my self hosted docker instances via Coolify which suits my needs. If I were to set up an ecommerce or other site that needs to guarantee trust, I would absolutely use a paid ssl cert.
Personally, I distrust any ecommerce site that uses any free cert. I see paid cert as a commitment to do honest business, as they need to have some records on the CA.
But for a blog or anythings other than ecommerce is totally fine by me.
Note: It is not about security, nor automation, but a show commitment (i.e. buying a cert), largely psycological.
Certain unnamed companies coughgoogle doesn’t like to trust Let Encrypt its definitely not an abuse of an illegal monopoly they have good reasons I promise.
But the whole point behind using a signed certificate is that other people can look at you and immediately know you are who you say you are if a company doesn’t trust you it doesn’t really matter what the motivation is you might as well use a self signed certificate.
Paid certificates have the money to make sure everyone trusts them and has a reputation to maintain so are more likely to defend a legitimate complaint.
99.999% of individuals it simply doesn’t matter(although you might have to look into it if you’re using android apps) but to a company the little bit that certification costs is worth every penny.
Not the only use cases, but you’d need a different service if you need/want wildcard certs, certs that are manually installed and managed, or certs with a longer expiration.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
I’ve used Lets Encrypt for years and years, in fact it’s been at least 6?. LE with the encryptbot?, automate the entire process, and then completely forget about it until someone posts on Lemmy asking about it.
It’s been long enough I’ve forgotten the proper names of the software and I would have to go back through my notes to recreate it.
Just checked the logs and it’s fine.
Don’t pay for shit.
The point of paid SSL at this stage in the game are the higher tiers of verification. Instead of just verifying that you own the domain, you can verify that you are who you say you are. These are called Extended Validation and Organizational Validation certificates. This has historically been desirable by businesses. It used to be that these higher tier certs would not only give you a lock icon in the address bar of a web browser, but also a little blurb confirming your organization is legit. Not sure if this is still the case though. You will see the extended validation when you check the sites certificate though for sure.
As far as encryption and security, there’s no difference. Also side note, the Comodo brand still technically exists but it was bought by Sectigo like 7 years ago.
Let’s encrypt, and any other ACME based certificate of authorities will let anyone without identity verification create a SSL cert that will work in any browser. This creates trust issues with certain clients browsing web. For example my work (50k+ employees) uses Zscaler to evaluate if a website is safe and it 100% will down-votes any site that uses let’s encrypt due to the lack of transparency. Zscaler will eventually block that website from employees if the score falls too low. Having an SSL cert that you pay for gives cyber security, firms - rightly or wrongly - an additional level of confidence that your identity has been verified.
Full disclosure: I use let’s encrypt on all my self hosted docker instances via Coolify which suits my needs. If I were to set up an ecommerce or other site that needs to guarantee trust, I would absolutely use a paid ssl cert.
Personally, I distrust any ecommerce site that uses any free cert. I see paid cert as a commitment to do honest business, as they need to have some records on the CA.
But for a blog or anythings other than ecommerce is totally fine by me.
Note: It is not about security, nor automation, but a show commitment (i.e. buying a cert), largely psycological.
Let’s Encrypt is just as secure as paid certs. They’re held to the same security standard.
Certain unnamed companies coughgoogle doesn’t like to trust Let Encrypt its definitely not an abuse of an illegal monopoly they have good reasons I promise.
But the whole point behind using a signed certificate is that other people can look at you and immediately know you are who you say you are if a company doesn’t trust you it doesn’t really matter what the motivation is you might as well use a self signed certificate.
Paid certificates have the money to make sure everyone trusts them and has a reputation to maintain so are more likely to defend a legitimate complaint.
99.999% of individuals it simply doesn’t matter(although you might have to look into it if you’re using android apps) but to a company the little bit that certification costs is worth every penny.
Not the only use cases, but you’d need a different service if you need/want wildcard certs, certs that are manually installed and managed, or certs with a longer expiration.