I’m curious what the benefits are of paying for SSL certificates vs using a free provider such as letsencrypt.

What exactly are you trusting a cert provider with and what are the security implications? What attack vectors do you open yourself up to when trusting a certificate authority with your websites’ certificates?

In what way could it benefit security and/or privacy to utilize a paid service?

And finally, which paid SSL providers are considered trustworthy?

I know Digicert is a big player, but their prices are insane. Comodo seems like a good affordable option, but is it a trustworthy company?

  • Possibly linux@lemmy.zipEnglish
    0·
    3 months ago

    I don’t understand what digicert could possibly do that Let’s encrypt doesn’t. Let’s encrypt is free and transparent. Digicert is just a relic from the past. Don’t believe me? Look at the number of websites using Let’s encrypt

    Unless you are in a specific industry Let’s encrypt is a good and sane choice

    • gencha@lemm.eeEnglish
      0·
      3 months ago

      I actually agree. For the majority of sites and/or use cases, it probably is sufficient.

      Explaining properly why LE is generally problematic, takes considerable depth of information, that I’m just not able to relay easily right now. But consider this:

      LE is mostly a convenience. They save an operator $1 per month per certificate. For everyone with hosting costs beyond $1000, this is laughable savings. People who take TLS seriously often have more demands than “padlock in the browser UI”. If a free service decides they no longer want to use OCSP, that’s an annoying disruption that was entirely not worth the $1 https://www.abetterinternet.org/post/replacing-ocsp-with-crls/

      LE has no SLA. You have no guarantee to be able to ever renew your certificate again. A risk not anyone should take.

      Who is paying for LE? If you’re not paying, how can you rely on the service to exist tomorrow?

      It’s not too long ago that people said “only some sites need HTTPS, HTTP is fine for most”. It never was, and people should not build anything relevant on “free” security today either.