I’m curious what the benefits are of paying for SSL certificates vs using a free provider such as letsencrypt.

What exactly are you trusting a cert provider with and what are the security implications? What attack vectors do you open yourself up to when trusting a certificate authority with your websites’ certificates?

In what way could it benefit security and/or privacy to utilize a paid service?

And finally, which paid SSL providers are considered trustworthy?

I know Digicert is a big player, but their prices are insane. Comodo seems like a good affordable option, but is it a trustworthy company?

  • @PlexSheep@infosec.pub
    link
    fedilink
    English
    43 months ago

    In that case, i recommend step-ca, which is a certificate authority server with acme support anyone can self host. The setup took a while but it’s been running for months now without problems for me.

    • @N0x0n@lemmy.ml
      link
      fedilink
      English
      23 months ago

      Yeaaah I already played a bit arround with step-ca ! Right now a make a mini-CA with openssl.

      When I get more comfortable with how everything works together I will surely give step-ca another try.

      • @PlexSheep@infosec.pub
        link
        fedilink
        English
        13 months ago

        I found open-ssl to be much harder to use. Do you just manually make new certificates with the CA in CLI?