I’m curious what the benefits are of paying for SSL certificates vs using a free provider such as letsencrypt.

What exactly are you trusting a cert provider with and what are the security implications? What attack vectors do you open yourself up to when trusting a certificate authority with your websites’ certificates?

In what way could it benefit security and/or privacy to utilize a paid service?

And finally, which paid SSL providers are considered trustworthy?

I know Digicert is a big player, but their prices are insane. Comodo seems like a good affordable option, but is it a trustworthy company?

  • cron@feddit.orgEnglish
    3·
    2 months ago

    AFAIK, the only reason not to use Letsencrypt are when you are not able to automate the process to change the certificate.

    As the paid certificates are valid for 12 month, you have to change them less often than a letsencrypt certificate.

    At work, we pay something like 30-50€ for a certificate for a year. As changing certificates costs, it is more economical to buy a certificate.

    But generally, it is best to use letsencrypt when you can automate the process (e.g. with nginx).

    As for the question of trust: The process of issuing certificates is done in a way that the certificate authority never has access to your private key. You don’t trust the CA with anything (except your payment data maybe).

    • lud@lemm.eeEnglish
      2·
      2 months ago

      PSA: All public certificates (private internal certificates won’t be affected) will have a lifetime of only 90 days soon. Google is planning to reduce their lifetime in 2024 but considering that they haven’t given an update on this since early this year, I doubt it will happen this year.

      But it will happen soon.

      This will be a pain in the ass for my workplace because we primarily use Digicert and manually renewing certificates every 90 days is just impossible for use. We are currently looking into a way to switch to letsencrypt or similar.

      • cron@feddit.orgEnglish
        2·
        2 months ago

        You’re right, Google released their vision in 2023, here is what it says regarding lifespan:

        a reduction of TLS server authentication subscriber certificate maximum validity from 398 days to 90 days. Reducing certificate lifetime encourages automation and the adoption of practices that will drive the ecosystem away from baroque, time-consuming, and error-prone issuance processes. These changes will allow for faster adoption of emerging security capabilities and best practices, and promote the agility required to transition the ecosystem to quantum-resistant algorithms quickly. Decreasing certificate lifetime will also reduce ecosystem reliance on “broken” revocation checking solutions that cannot fail-closed and, in turn, offer incomplete protection. Additionally, shorter-lived certificates will decrease the impact of unexpected Certificate Transparency Log disqualifications.

      • PlexSheep@infosec.pubEnglish
        1·
        2 months ago

        The background is that certificate revocation is a broken system and having short lived certificates makes the problem go away. You don’t need to worry about how to tell people that some certificate is bad if it’s only valid for a few days.

        Ideally, certificates would only be valid for a few days, it should be automated anyway. This has other downsides as I can imagine, like creation of more traffic. My self signed CA for my home LAN has 4 days as standard, and it works perfectly fine.

    • WIPocket@lemmy.worldEnglish
      0·
      2 months ago

      There are more reasons, as LetsEncrypt might be more restrictive on what you can get (for example, you cant get a certificate for an IP address from them). But, as 99.99% of usecases do not require anything like that, go with letsencrypt until you know of a reason not to.

      • PlexSheep@infosec.pubEnglish
        01·
        2 months ago

        No proper CA should give out a certificate for an IP, that’s a no go by the common rules.