6 ms·

Let's Encrypt isn't the first to offer free TLS certificates. I've attempted to maintain a list of all the providers that do (in one way or another), and it's

Let's Encrypt isn't the first to offer free TLS certificates. I've attempted to maintain a list of all the providers that do (in one way or another), and it's currently 4: * CloudFlare https://www.cloudflare.com/ssl https://www.cloudflare.com/ssl * StartSSL https://startssl.com https://startssl.com * WoSign https://buy.wosign.com/free https://buy.wosign.com/free * Let's Encrypt https://letsencrypt.org https://letsencrypt.org For people reading this comment dozens of months in the future, a maintained list will be kept at https://paragonie.com/white-paper/2015-secure-php-data-encryption https://paragonie.com/white-paper/2015-secure-php-data-encry...

mehrdada 11y ago
They are not quite the same thing: * CloudFlare doesn't give you a certificate. It terminates your TLS connection at their endpoint with a certificate they own the private key to. * StartSSL free tier is for non-commerical use only. * Haven't used WoSign so no idea what it is, but clicking on the link took was so laggy it didn't give me much confidence. (I personally wouldn't work with a company in China jurisdiction when it comes to security products.) Let's Encrypt is a big step forward in having a legitimate, actual, user-friendly, free TLS certificate issuer without restrictions for usage scenarios.
- icelancer 11y ago
  > user-friendly This is the key. StartSSL is NOT user-friendly at all, even if you want to use it for the non-commercial personal use that it was designed for.
  - david-given 11y ago
    StartSSL is so painfully obtuse and difficult to use that I eventually just gave up and paid someone to do it for me.
  - b3lvedere 11y ago
    I'm quite pleased with StartSSL. Although i agree that their user interface isn't that much user friendly, it took me just a couple of hours to learn how the process is handled at StartSSL. You let them create a certificate you then use for your login process. Then you validate your domain by email and then you're pretty much valid to pump out as much certificates as you want. Only drawback is that the certificates are only valid for one year.
    - huskyr 11y ago
      > it took me just a couple of hours > to learn how the process is handled at StartSSL. Well, if something takes 'just a couple of hours' to learn i'll happily fork over some money to ease the pain. You can get certificates for $10/year nowadays.
      - ghshephard 11y ago
        "You can get certificates for $10/year nowadays." As a service to the community, could you name some places where you can do that?
        scrollaway 11y ago
        https://www.namecheap.com/security/ssl-certificates.aspx https://www.namecheap.com/security/ssl-certificates.aspx
        deleted 11y ago
        [deleted]
        icebraining 11y ago
        Here's $5/y if you buy 3 years: https://www.ssls.com/ssl-certificates/comodo-positivessl https://www.ssls.com/ssl-certificates/comodo-positivessl
        pcunite 11y ago
        I've been using namecheap.com. They work well. Will probably switch to Let's Encrypt in three years if everything checks out okay with them.
- sschueller 11y ago
  What would be the difference in using WoSign vs any other? If you use a CSR and not let them generate the private key I would think their certificates are identical to any other providers.
  - mehrdada 11y ago
    It doesn't matter much for TLS certificates (the slowness might though) except if they choose to issue another certificate under your name with their private key to MITM your connections, it'd look more legitimate if your real certificate is issued by the same CA, but admittedly, the real issue here is on the client side: browsers trusting way too many CAs that directly include many governments.
- sarciszewski 11y ago
  > (I personally wouldn't work with a company in China jurisdiction when it comes to security products.) I could say the same for most countries.
- devy 11y ago
  FYI, StartSSL's free personal SSL certificate only valid for new users for the first year, requires a valid U.S. physical non-commercial address for registration and is subject to $79 for revocation fee. Oh, it's definitely not automated, someone would have to email you back and force a couple times to complete the provision process. I wouldn't bother with StartSSL with that many catches and hassles. How do I know? I've got two of them in the past in two occasions.
  - talideon 11y ago
    > FYI, StartSSL's free personal SSL certificate only valid for new users for the first year They only allow one-year certs to be generated, but you can renew them and get as many of them as you want. I've got class one certs from them for two different domains, and I've replaced both those certs twice as they've expired. Then again, maybe they've changed their policies in the past six months. > requires a valid U.S. physical non-commercial address for registration Does it? I'm based in Ireland, and I haven't had to provide the with a valid US physical address, unless this is something new that they've brought in during the last half a year or so. > and is subject to $79 for revocation fee. Yup, that's the most annoying thing about dealing with them. > Oh, it's definitely not automated, someone would have to email you back and force a couple times to complete the provision process. I can't say I've had that issue myself. They're not as fast as I'd like, but I've never had any major problems with them.
- hackerboos 11y ago
  I use WoSign. Free 3 year certificates although I'm not using it for security just to enable SPDY.
nothrabannosir 11y ago
In addition to the other differences, as far as I know letsencrypt is the first to offer free and automated certs. None of the other ones offer an API, do they?
mtgx 11y ago
One of them is not like the other, and that's CloudFlare's free SSL, which is more like "half-SSL". You only get free encryption between Cloudflare and the user, but not between your site and Cloudflare.
- lorenzhs 11y ago
  I don't think that's true anymore, see https://www.cloudflare.com/ssl https://www.cloudflare.com/ssl ("Full SSL" and "Full SSL (strict)" options)
  - incarnate 11y ago
    Ah, but to use the Full SSL options you need an SSL on your origin server (which CloudFlare doesn't provide for free)!
    - BillinghamJ 11y ago
      That certificate can be self signed.
      - mehrdada 11y ago
        In which case, it can be easily MITM'd by an attacker sitting between CloudFlare and your server, which makes it only slightly better than plain HTTP. It would have been great if CloudFlare let the user to upload and pin a specific self-signed certificate that it could then validate to prevent such attacks.
      - gurrone 11y ago
        I think there was some rumors that they are - or are planing - to offer certificates signed by a private Cloudflare CA exactly for the purpose of encrypting the traffic to the backend.
  - johncolanduoni 11y ago
    Unfortunately, this means you either have to use a self-signed cert which CloudFlare will not verify at all (meaning it can be MITMed) or use one signed by a trusted CA... which brings you back to square one.

mehrdada 11y ago

They are not quite the same thing: * CloudFlare doesn't give you a certificate. It terminates your TLS connection at their endpoint with a certificate they own the private key to. * StartSSL free tier is for non-commerical use only. * Haven't used WoSign so no idea what it is, but clicking on the link took was so laggy it didn't give me much confidence. (I personally wouldn't work with a company in China jurisdiction when it comes to security products.) Let's Encrypt is a big step forward in having a legitimate, actual, user-friendly, free TLS certificate issuer without restrictions for usage scenarios.

icelancer 11y ago
> user-friendly This is the key. StartSSL is NOT user-friendly at all, even if you want to use it for the non-commercial personal use that it was designed for.
- david-given 11y ago
  StartSSL is so painfully obtuse and difficult to use that I eventually just gave up and paid someone to do it for me.
- b3lvedere 11y ago
  I'm quite pleased with StartSSL. Although i agree that their user interface isn't that much user friendly, it took me just a couple of hours to learn how the process is handled at StartSSL. You let them create a certificate you then use for your login process. Then you validate your domain by email and then you're pretty much valid to pump out as much certificates as you want. Only drawback is that the certificates are only valid for one year.
  - huskyr 11y ago
    > it took me just a couple of hours > to learn how the process is handled at StartSSL. Well, if something takes 'just a couple of hours' to learn i'll happily fork over some money to ease the pain. You can get certificates for $10/year nowadays.
    - ghshephard 11y ago
      "You can get certificates for $10/year nowadays." As a service to the community, could you name some places where you can do that?
      - scrollaway 11y ago
        https://www.namecheap.com/security/ssl-certificates.aspx https://www.namecheap.com/security/ssl-certificates.aspx
      - deleted 11y ago
        [deleted]
      - icebraining 11y ago
        Here's $5/y if you buy 3 years: https://www.ssls.com/ssl-certificates/comodo-positivessl https://www.ssls.com/ssl-certificates/comodo-positivessl
      - pcunite 11y ago
        I've been using namecheap.com. They work well. Will probably switch to Let's Encrypt in three years if everything checks out okay with them.
sschueller 11y ago
What would be the difference in using WoSign vs any other? If you use a CSR and not let them generate the private key I would think their certificates are identical to any other providers.
- mehrdada 11y ago
  It doesn't matter much for TLS certificates (the slowness might though) except if they choose to issue another certificate under your name with their private key to MITM your connections, it'd look more legitimate if your real certificate is issued by the same CA, but admittedly, the real issue here is on the client side: browsers trusting way too many CAs that directly include many governments.
sarciszewski 11y ago
> (I personally wouldn't work with a company in China jurisdiction when it comes to security products.) I could say the same for most countries.
devy 11y ago
FYI, StartSSL's free personal SSL certificate only valid for new users for the first year, requires a valid U.S. physical non-commercial address for registration and is subject to $79 for revocation fee. Oh, it's definitely not automated, someone would have to email you back and force a couple times to complete the provision process. I wouldn't bother with StartSSL with that many catches and hassles. How do I know? I've got two of them in the past in two occasions.
- talideon 11y ago
  > FYI, StartSSL's free personal SSL certificate only valid for new users for the first year They only allow one-year certs to be generated, but you can renew them and get as many of them as you want. I've got class one certs from them for two different domains, and I've replaced both those certs twice as they've expired. Then again, maybe they've changed their policies in the past six months. > requires a valid U.S. physical non-commercial address for registration Does it? I'm based in Ireland, and I haven't had to provide the with a valid US physical address, unless this is something new that they've brought in during the last half a year or so. > and is subject to $79 for revocation fee. Yup, that's the most annoying thing about dealing with them. > Oh, it's definitely not automated, someone would have to email you back and force a couple times to complete the provision process. I can't say I've had that issue myself. They're not as fast as I'd like, but I've never had any major problems with them.
hackerboos 11y ago
I use WoSign. Free 3 year certificates although I'm not using it for security just to enable SPDY.

nothrabannosir 11y ago

In addition to the other differences, as far as I know letsencrypt is the first to offer free and automated certs. None of the other ones offer an API, do they?

mtgx 11y ago

One of them is not like the other, and that's CloudFlare's free SSL, which is more like "half-SSL". You only get free encryption between Cloudflare and the user, but not between your site and Cloudflare.

lorenzhs 11y ago
I don't think that's true anymore, see https://www.cloudflare.com/ssl https://www.cloudflare.com/ssl ("Full SSL" and "Full SSL (strict)" options)
- incarnate 11y ago
  Ah, but to use the Full SSL options you need an SSL on your origin server (which CloudFlare doesn't provide for free)!
  - BillinghamJ 11y ago
    That certificate can be self signed.
    - mehrdada 11y ago
      In which case, it can be easily MITM'd by an attacker sitting between CloudFlare and your server, which makes it only slightly better than plain HTTP. It would have been great if CloudFlare let the user to upload and pin a specific self-signed certificate that it could then validate to prevent such attacks.
    - gurrone 11y ago
      I think there was some rumors that they are - or are planing - to offer certificates signed by a private Cloudflare CA exactly for the purpose of encrypting the traffic to the backend.
- johncolanduoni 11y ago
  Unfortunately, this means you either have to use a self-signed cert which CloudFlare will not verify at all (meaning it can be MITMed) or use one signed by a trusted CA... which brings you back to square one.