I’m curious what the benefits are of paying for SSL certificates vs using a free provider such as letsencrypt.

What exactly are you trusting a cert provider with and what are the security implications? What attack vectors do you open yourself up to when trusting a certificate authority with your websites’ certificates?

In what way could it benefit security and/or privacy to utilize a paid service?

And finally, which paid SSL providers are considered trustworthy?

I know Digicert is a big player, but their prices are insane. Comodo seems like a good affordable option, but is it a trustworthy company?

    • teawrecks@sopuli.xyzEnglish
      4·
      2 months ago

      I think their question is, what do you mean by “secure”? Because as the saying goes for internet services: usually, if you’re not paying, you’re not the customer, you’re the product.

      • Laser@feddit.orgEnglish
        4·
        2 months ago

        A lot of paid cert providers were not so great before LE or the spotlight on the issue; it was more of a scheme to extract money from operators who couldn’t afford to not offer TLS / SSL. https://bugzilla.mozilla.org/show_bug.cgi?id=647959 was a famous post that made fun of / criticized the system before LE. This hurt security, and if not free, LE wouldn’t have worked.