105
Paid SSL vs Letsencrypt
(lemmy.ml)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 12 Sep 2024
105 points (97.3% liked)
Selfhosted
40458 readers
94 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
Personally, I distrust any ecommerce site that uses any free cert. I see paid cert as a commitment to do honest business, as they need to have some records on the CA.
But for a blog or anythings other than ecommerce is totally fine by me.
Note: It is not about security, nor automation, but a show commitment (i.e. buying a cert), largely psycological.
Let's Encrypt is just as secure as paid certs. They're held to the same security standard.
even more secure with the 90 days policy.
Better as they are more transparent
Most paid certs aren't worth much anyway. Payment and delivery info for DV certs isn't validated by anyone, it's literally the same concept as Let's Encrypt. OV and EV are the only ones that theoretically have any value, but nobody is using those ever since they got rid of the URL bar labeling; even Amazon is on DV nowadays.
Nothing of value was lost when EV certificates disappeared.
Well the cert companies were harmed
IMO, sticking to manual processes that are error-prone is a waste of money and not a sign of a honest business.
I don't believe paid cert can't use automation to keep certs upto date.
Proof: https://docs.digicert.com/en/certcentral/certificate-tools/certificate-lifecycle-automation-guides/automation-service-overview.html
You're right, ssl.com offers this, too.
LetsEncrypt is legit. A downside is that the certs expire after 90 days. However, that also carries an upside in that it limits the damage in case a certificate is compromised. There are procedures by which you can automatically renew/request (I forget whether they allow renewing an existing cert or require a brand new one) LE certs and apply them to your application, but that can be fiddly to configure.
If you're not comfortable with configuring automatic certificate cycling, a long-term paid cert would be more appropriate.
It makes sense that they issue short certificates, though. The sole verification is that you own the domain. If you sell/let the domain lapse and someone else takes it over, there's only a limited time you would hold a valid certificate for it.
I didn't say it isn't legit nor I distrust automation, but I would like to see anyone operating an online shop paid for a cert to show they are honest and won't diappear in thin air not delivering. Am I going to get back what I paid, properly not, but a basic DV cert isn't expensive either for a business.
LetsEncrypt certs are DV certs. That a put a TXT record for LetsEncrypt vs a TXT record for a paid DigiCert makes no difference whatsoever.
I just checked and Shopify uses a LetsEncrypt cert, so that's a big one that uses the plebian certs.
The difference between $0 and $50 isn't really relevant.
Then I don't see any problem for them just put down $50 more.
Bad actors can afford $50 the same as good ones.
Would you accept a certificate issued by AWS (Amazon)? Or GCP (Google)? Or azure (Microsoft)? Do you visit websites behind cloudflare with CF issued certs? Because all 4 of those certificates are free. There is no identity validation for signing up for any of them really past having access to some payment form (and I don't even think all of them do even that). And you could argue between those 4 companies it's about 80-90% of the traffic on the internet these days.
Paid vs free is not a reliable comparison for trust. If anything, non-automated processes where a random engineer just gets the new cert and then hopefully remembers to delete it has a number of risk factors that doesn't exist with LE (or other ACME supporting providers).
I would say the more regular expiration and renewal of an LE cert is better.
It's an ongoing check instead of an annual check.