I’m curious what the benefits are of paying for SSL certificates vs using a free provider such as letsencrypt.

What exactly are you trusting a cert provider with and what are the security implications? What attack vectors do you open yourself up to when trusting a certificate authority with your websites’ certificates?

In what way could it benefit security and/or privacy to utilize a paid service?

And finally, which paid SSL providers are considered trustworthy?

I know Digicert is a big player, but their prices are insane. Comodo seems like a good affordable option, but is it a trustworthy company?

  • teawrecks@sopuli.xyz
    link
    fedilink
    English
    arrow-up
    4
    ·
    2 months ago

    I think their question is, what do you mean by “secure”? Because as the saying goes for internet services: usually, if you’re not paying, you’re not the customer, you’re the product.

    • Laser@feddit.org
      link
      fedilink
      English
      arrow-up
      4
      ·
      2 months ago

      A lot of paid cert providers were not so great before LE or the spotlight on the issue; it was more of a scheme to extract money from operators who couldn’t afford to not offer TLS / SSL. https://bugzilla.mozilla.org/show_bug.cgi?id=647959 was a famous post that made fun of / criticized the system before LE. This hurt security, and if not free, LE wouldn’t have worked.