I’m curious what the benefits are of paying for SSL certificates vs using a free provider such as letsencrypt.
What exactly are you trusting a cert provider with and what are the security implications? What attack vectors do you open yourself up to when trusting a certificate authority with your websites’ certificates?
In what way could it benefit security and/or privacy to utilize a paid service?
And finally, which paid SSL providers are considered trustworthy?
I know Digicert is a big player, but their prices are insane. Comodo seems like a good affordable option, but is it a trustworthy company?
You must log in or register to comment.
The background is that certificate revocation is a broken system and having short lived certificates makes the problem go away. You don’t need to worry about how to tell people that some certificate is bad if it’s only valid for a few days.
Ideally, certificates would only be valid for a few days, it should be automated anyway. This has other downsides as I can imagine, like creation of more traffic. My self signed CA for my home LAN has 4 days as standard, and it works perfectly fine.
Yeah, absolutely!
I actually like the change.
It’s just that it will create a lot of work for us (especially for me and my colleague) short term. I would very much appreciate it if Google actually bothered to give an exact timeline (optimally a few months or a year in advance).