I’m curious what the benefits are of paying for SSL certificates vs using a free provider such as letsencrypt.
What exactly are you trusting a cert provider with and what are the security implications? What attack vectors do you open yourself up to when trusting a certificate authority with your websites’ certificates?
In what way could it benefit security and/or privacy to utilize a paid service?
And finally, which paid SSL providers are considered trustworthy?
I know Digicert is a big player, but their prices are insane. Comodo seems like a good affordable option, but is it a trustworthy company?
Let’s encrypt, and any other ACME based certificate of authorities will let anyone without identity verification create a SSL cert that will work in any browser. This creates trust issues with certain clients browsing web. For example my work (50k+ employees) uses Zscaler to evaluate if a website is safe and it 100% will down-votes any site that uses let’s encrypt due to the lack of transparency. Zscaler will eventually block that website from employees if the score falls too low. Having an SSL cert that you pay for gives cyber security, firms - rightly or wrongly - an additional level of confidence that your identity has been verified.
Full disclosure: I use let’s encrypt on all my self hosted docker instances via Coolify which suits my needs. If I were to set up an ecommerce or other site that needs to guarantee trust, I would absolutely use a paid ssl cert.
Neither does Google Trust Services or DigiCert. They’re all HTTP validation on Cloudflare and we have Fortune 100 companies served with LetsEncrypt certs.
I haven’t seen an EV cert in years, browsers stopped caring ages ago. It’s all been domain validated.
LetsEncrypt publicly logs which IP requested a certificate, that’s a lot more than what regular CAs do.
I guess one more to the pile of why everyone hates Zscaler.
DigiCert recently was forced to invalidate something like 50,000 of their DNS-challenge based certs because of a bug in their system, and they gave companies like mine only 24 hours to renew them before invalidating the old ones…
hey I don’t make the trust rules. ZScaler is trash imo but hundreds of thousands of clients are ‘protected’ by their trust rules. People downvoting my post because it doesn’t wash with ‘the way things should be’ but in reality SSL certs are like email providers these days - if you aren’t paying with one of the big corps, a good portion of your web traffic (or email) might be blocked. Sad but true. There is a reason Let’s Encrypt and Cloudflare et al are heavily used by Crypto sites, and that is due to the anonymity they provide. If all you care about is encrypting traffic, use Let’s Encrypt. If you care at all about perception of trust, use paid SSL. simple.
these are subdomains of a verifiably certified root domain no doubt
Untrue. I work for a global enterprise company that transacts hundreds of millions of dollars via LE certs.
I believe you, but I also very much believe that there are security vendors out there demonizing LE and free stuff in general. The more expensive equals better more serious thinking is unfortunately still quite present, especially in big corps. Big corps also seem to like the concept of having to prove yourself with a high price of entry, they just can’t believe a tiny company could possibly have a better product.
That doesn’t make it any less ridiculous, but I believe it. I’ve definitely heard my share of “we must use $sketchyVendor because $dubiousReason”. I’ve had to install ClamAV on readonly diskless VMs at work because otherwise customers refuse to sign because “we have no security systems”. Everything has to be TLS encrypted, even if it goes to localhost. Box checkers vs common sense.
The B2B use case isn’t quite what I was referring to with respect to the type of trust required for first time or consumer transactions such as ecommerce. That said, this enterprise doesn’t sound federally regulated at all because if it were, it wouldn’t be using Let’s Encrypt.
That’s frankly silly. Let’s encrypt makes sure you control either the domain or a server the domain points to.
Almost all of the internet uses Let’s encrypt
‘ Control’ but not own, which leaves it open to criminal activity. In contrast, a SSL certificate authority will ask for multiple pieces of ID for corporate registrants including articles of incorporation.