I’m curious what the benefits are of paying for SSL certificates vs using a free provider such as letsencrypt.
What exactly are you trusting a cert provider with and what are the security implications? What attack vectors do you open yourself up to when trusting a certificate authority with your websites’ certificates?
In what way could it benefit security and/or privacy to utilize a paid service?
And finally, which paid SSL providers are considered trustworthy?
I know Digicert is a big player, but their prices are insane. Comodo seems like a good affordable option, but is it a trustworthy company?
Personally, I distrust any ecommerce site that uses any free cert. I see paid cert as a commitment to do honest business, as they need to have some records on the CA.
But for a blog or anythings other than ecommerce is totally fine by me.
Note: It is not about security, nor automation, but a show commitment (i.e. buying a cert), largely psycological.
IMO, sticking to manual processes that are error-prone is a waste of money and not a sign of a honest business.
I don’t believe paid cert can’t use automation to keep certs upto date.
Most paid certs aren’t worth much anyway. Payment and delivery info for DV certs isn’t validated by anyone, it’s literally the same concept as Let’s Encrypt. OV and EV are the only ones that theoretically have any value, but nobody is using those ever since they got rid of the URL bar labeling; even Amazon is on DV nowadays.
Let’s Encrypt is just as secure as paid certs. They’re held to the same security standard.
LetsEncrypt is legit. A downside is that the certs expire after 90 days. However, that also carries an upside in that it limits the damage in case a certificate is compromised. There are procedures by which you can automatically renew/request (I forget whether they allow renewing an existing cert or require a brand new one) LE certs and apply them to your application, but that can be fiddly to configure.
If you’re not comfortable with configuring automatic certificate cycling, a long-term paid cert would be more appropriate.
I didn’t say it isn’t legit nor I distrust automation, but I would like to see anyone operating an online shop paid for a cert to show they are honest and won’t diappear in thin air not delivering. Am I going to get back what I paid, properly not, but a basic DV cert isn’t expensive either for a business.
Would you accept a certificate issued by AWS (Amazon)? Or GCP (Google)? Or azure (Microsoft)? Do you visit websites behind cloudflare with CF issued certs? Because all 4 of those certificates are free. There is no identity validation for signing up for any of them really past having access to some payment form (and I don’t even think all of them do even that). And you could argue between those 4 companies it’s about 80-90% of the traffic on the internet these days.
Paid vs free is not a reliable comparison for trust. If anything, non-automated processes where a random engineer just gets the new cert and then hopefully remembers to delete it has a number of risk factors that doesn’t exist with LE (or other ACME supporting providers).
