I’m curious what the benefits are of paying for SSL certificates vs using a free provider such as letsencrypt.

What exactly are you trusting a cert provider with and what are the security implications? What attack vectors do you open yourself up to when trusting a certificate authority with your websites’ certificates?

In what way could it benefit security and/or privacy to utilize a paid service?

And finally, which paid SSL providers are considered trustworthy?

I know Digicert is a big player, but their prices are insane. Comodo seems like a good affordable option, but is it a trustworthy company?

  • umami_wasabi@lemmy.ml
    link
    fedilink
    English
    arrow-up
    5
    arrow-down
    16
    ·
    edit-2
    22 days ago

    Personally, I distrust any ecommerce site that uses any free cert. I see paid cert as a commitment to do honest business, as they need to have some records on the CA.

    But for a blog or anythings other than ecommerce is totally fine by me.

    Note: It is not about security, nor automation, but a show commitment (i.e. buying a cert), largely psycological.

    • False@lemmy.world
      link
      fedilink
      English
      arrow-up
      10
      ·
      22 days ago

      Let’s Encrypt is just as secure as paid certs. They’re held to the same security standard.

    • chameleon@fedia.io
      link
      fedilink
      arrow-up
      8
      ·
      22 days ago

      Most paid certs aren’t worth much anyway. Payment and delivery info for DV certs isn’t validated by anyone, it’s literally the same concept as Let’s Encrypt. OV and EV are the only ones that theoretically have any value, but nobody is using those ever since they got rid of the URL bar labeling; even Amazon is on DV nowadays.

    • cron@feddit.org
      link
      fedilink
      English
      arrow-up
      8
      arrow-down
      1
      ·
      22 days ago

      IMO, sticking to manual processes that are error-prone is a waste of money and not a sign of a honest business.

    • Nougat@fedia.io
      link
      fedilink
      arrow-up
      4
      ·
      22 days ago

      LetsEncrypt is legit. A downside is that the certs expire after 90 days. However, that also carries an upside in that it limits the damage in case a certificate is compromised. There are procedures by which you can automatically renew/request (I forget whether they allow renewing an existing cert or require a brand new one) LE certs and apply them to your application, but that can be fiddly to configure.

      If you’re not comfortable with configuring automatic certificate cycling, a long-term paid cert would be more appropriate.

      • r00ty@kbin.life
        link
        fedilink
        arrow-up
        1
        ·
        22 days ago

        It makes sense that they issue short certificates, though. The sole verification is that you own the domain. If you sell/let the domain lapse and someone else takes it over, there’s only a limited time you would hold a valid certificate for it.

      • umami_wasabi@lemmy.ml
        link
        fedilink
        English
        arrow-up
        3
        arrow-down
        5
        ·
        edit-2
        22 days ago

        I didn’t say it isn’t legit nor I distrust automation, but I would like to see anyone operating an online shop paid for a cert to show they are honest and won’t diappear in thin air not delivering. Am I going to get back what I paid, properly not, but a basic DV cert isn’t expensive either for a business.

        • Max-P@lemmy.max-p.me
          link
          fedilink
          English
          arrow-up
          9
          ·
          edit-2
          22 days ago

          LetsEncrypt certs are DV certs. That a put a TXT record for LetsEncrypt vs a TXT record for a paid DigiCert makes no difference whatsoever.

          I just checked and Shopify uses a LetsEncrypt cert, so that’s a big one that uses the plebian certs.

        • myliltoehurts@lemm.ee
          link
          fedilink
          English
          arrow-up
          1
          ·
          21 days ago

          Would you accept a certificate issued by AWS (Amazon)? Or GCP (Google)? Or azure (Microsoft)? Do you visit websites behind cloudflare with CF issued certs? Because all 4 of those certificates are free. There is no identity validation for signing up for any of them really past having access to some payment form (and I don’t even think all of them do even that). And you could argue between those 4 companies it’s about 80-90% of the traffic on the internet these days.

          Paid vs free is not a reliable comparison for trust. If anything, non-automated processes where a random engineer just gets the new cert and then hopefully remembers to delete it has a number of risk factors that doesn’t exist with LE (or other ACME supporting providers).

    • towerful@programming.dev
      link
      fedilink
      English
      arrow-up
      2
      ·
      22 days ago

      I would say the more regular expiration and renewal of an LE cert is better.
      It’s an ongoing check instead of an annual check.