I’m curious what the benefits are of paying for SSL certificates vs using a free provider such as letsencrypt.
What exactly are you trusting a cert provider with and what are the security implications? What attack vectors do you open yourself up to when trusting a certificate authority with your websites’ certificates?
In what way could it benefit security and/or privacy to utilize a paid service?
And finally, which paid SSL providers are considered trustworthy?
I know Digicert is a big player, but their prices are insane. Comodo seems like a good affordable option, but is it a trustworthy company?
You must log in or register to comment.
What exactly are you trusting a cert provider with and what are the security implications?
End users trust the cert provider. The cert provider has a process that they use to determine if they can trust you.
What attack vectors do you open yourself up to when trusting a certificate authority with your websites’ certificates?
You’re not really trusting them with your certificates. You don’t give them your private key or anything like that, and the certs are visible to anyone navigating to your website.
Your new vulnerabilities are basically limited to what you do for them - any changes you make to your domain’s DNS config, or anything you host, etc. - and depend on that introducing a vulnerability of its own. You also open a new phishing attack vector, where someone might contact you, posing as the certificate authority, and ask you to make a change that would introduce a vulnerability.
In what way could it benefit security and/or privacy to utilize a paid service?
For most use cases, as far as I know, it doesn’t.
LetsEncrypt doesn’t offer EV or OV certificates, which you may need for your use case. However, these are mostly relevant at the enterprise level. Maybe you have a storefront and want an EV cert?
LetsEncrypt also only offers community support, and if you set something up wrong you could be less secure.
Other CAs may offer services that enhance privacy and security, as well, like scanning your site to confirm your config is sound… but the core offering isn’t really going to be different (aside from LE having intentionally short renewal periods), and theoretically you could get those same services from a different vendor.
Let’s encrypt also don’t provide client certificates, or intermediates that allow you to sign them, which really is a shame.
Do EV and OV certs actually provide additional useful? When was the last time you reviewed the certificate of a site you access for non work purposes?
EV certs give you an extra green bar or something along those lines. If your customers care about it, then you have to. If they don’t - and they probably don’t - it’s a waste.
They got rid of that years ago though.
My employer had an EV cert for years on our primary domain. The C-suites, etc. thought it was important. Then one of our engineers who focuses on SEO demonstrated how the EV cert slowed down page loads enough that search engines like Google might take notice. Apparently EV certs trigger an additional lookup by the browser to confirm the extended validity.
Once the powers-that-be understood that the EV cert wasn’t offering any additional usefulness, and might be impacting our SEO performance (however small) they had us get rid of it and use a good old OV cert instead.
Good to know! I saw that mentioned on some (apparently outdated) Comodo marketing copy as a benefit over LE