4 ms·

Given that Let's Encrypt is free, is there any reason why someone would use paid service for SSL certificates?

by jsnk 11y ago

dtnewman 11y ago
If it integrates easily with AWS and the price is low, I would definitely take advantage of this.
- dexterdog 11y ago
  The price is very low. It's as low as they can go.
peterhadlaw 11y ago
So Let's Encrypt - awesome. On a side note, I was wondering what the difference is between the base certs issued by LE vs. those fancy super, extra double / triple level certs ("EV"? if I recall) practically speaking.
- givehimagun 11y ago
  LE enables Domain Validated certs...so you'll get a green lock in most browsers. The Extended Validation certs gives you the green lock AND the name of the organization. The EV assures you that the company you're doing business with has been vetted...but customers don't know and most have not been educated about the differences in encryption and trust.
- cookiecaper 11y ago
  The gimmick on the super fancy certs that give the big green bar w/ company name next to the URL is that they supposedly mean the CA has done a super thorough investigation on the company and verified that they really are who they say they are. Those certs cost like $1k from most vendors. This could be valuable if you get a lot of people trying to imitate your company or domain; for example, something like nikeshoes.com v. nike.com. But since most customers don't actually know any difference, the practical value is very small. By contrast, a normal SSL cert is issued just by confirming control of one of the domain's email addresses.
- evook 11y ago
  In memory of Honest Achmed there is none. And that comes from someone who works for a company that is a CA.
  - deleted 11y ago
    [deleted]
- nailer 11y ago
  TLDR: Whether someone checks who you are or not. Technically, it's the the difference between the baseline requirements (for all certs) and the EV requirements (required only for EV), which are at https://cabforum.org/wp-content/uploads/EV-V1_5_7.pdf https://cabforum.org/wp-content/uploads/EV-V1_5_7.pdf. In order to get an EV cert, you must pass those requirements, specifically: - government information sources - qualified independent information sources - all domain names must be inspected by a human - phone calls to your office Additionally Google mandates Certificate Transparency for EV, so all EV certs have CT as a result. EV is also required for .onion services, because what would be the point of anonymity unless you actually knew who you were talking to. In the 90s it took a long a long time for certs to be issued: you'd fax ID to VeriSign, they'd verify your identity and sign your certificate. DV was introduced by Geotrust as a way of saving money for CAs: DV just means you can register a domain: even if the domain seems like it belongs to a particular legal entity, DV makes no assurances that it does. People can and do get DV certs that seem like they're for major companies all the time. The process is entirely automated, and nobody is asserting any identity: https://google.com.mg https://google.com.mg and https://google.com.im https://google.com.im exist, they're not Google, and that's fine because DV certs don't assert identity. EV does actually assert a connection between the certificate and a specific legal identity, which is encoded in the certificate, signed and displayed in the browser. EV isn't perfect: you could attempt to be verified as another company. However it is the only type of certificate that assures an actual identity to browsers. Disclaimer: I work for a startup that's created significantly faster, more painless EV validation. We think it's important that Alice knows she's talking to Bob.
eknkc 11y ago
I recently needed a cert and got one from letsencrypt. Haven't read about them or followed all the news. I have no idea about the architecture of Let's Encrypt. So these might sound stupid; - Why do we need a local client app to issue certificates? Is there a web interface in development? Is there a technical reason for it to work this way? - Why does it issue 3 month certs? Beta period? (This is reason enough to pay btw, If I did not screw something up to end up with short term certs)
- mordocai 11y ago
  It gives 3 month certs because what you are supposed to be doing is automating the cert creation and when you have it automated 3 months certs are a good thing since it is a security benefit and has no disadvantages.
- TazeTSchnitzel 11y ago
  > Why do we need a local client app to issue certificates? So it can verify domain ownership automatically. > Why does it issue 3 month certs? Because it verifies domain ownership automatically.
  - serge2k 11y ago
    Well, that and they didn't do DNS based validation first. I guess they have that now.
    - deleted 11y ago
      [deleted]
- ianlevesque 11y ago
  They want you to automate renewals.
- herge 11y ago
  I suspect the 3 month certs is to make sure you have to authenticate your domain 4 times a year with Let's Encrypt to make sure that you can't hold a valid SSL key for the domain for more than a few months after you transfer it. Also, if someone manages to scam Let's Encrypt, the resulting cert is only valid for a short time. The local client is there to make sure that the authentication process can be automated and not require your manual intervention.
falcolas 11y ago
EV and wildcard certs, IMHO. ACM is offering the latter, and not the former.
- nikolay 11y ago
  With ELB, in most of my projects wildcard certificates are a must and thus Let's Encrypt is not an option. I hope one day (soon) they implement that as well.
Alex3917 11y ago
A 3-year wildcard cert from rapidSSL is only 200 bucks when purchased through a reseller. If going in that direction saves you even a couple hours over the course of three years, it's more than paid for itself.
- dexterdog 11y ago
  200 is pretty steep for a cert IMO
- serge2k 11y ago
  Great. Now what happens when you have to do a rotation because of another attack that makes it possible to leak private keys?
  - tombrossman 11y ago
    You generate a new CSR + private key and reissue the cert through the vendor. All the ones I've purchased allow reissuing as often as you like. The expiration date never changes obviously, but reissuing is a common practice.
    - serge2k 11y ago
      I was referring to the time spent doing something like that and the delay in response because of a lack of automation around rotating certs.
sandGorgon 11y ago
I have nurtured the secret belief that the reason that Letsencrypt renews certificates ("automatically") every three months is not a feature... but a forced limitation by the guys who own the root cert chain. If I'm a startup, why should I shirk away from paying 9.99 for a RapidSSL certificate from namecheap and have it working reliably through Ansible/Puppet/Docker... and rather muck about with the chance that my server SSL cert may go down because my letsencrypt client was outdated or something. Or worse, I have a wordpress site running on a PHP host - the best case scenario is that they agree to use a certificate I buy. Running a python based client ?
- bearbin 11y ago
  The LetsEncrypt root is in-house, not third party. Certificates are also cross-signed by IdenTrust, but once the LetsEncrypt root is in all major browsers, it won't be necessary to have a cross-signature. That's not to say that they don't have some other motive for the 90 day expiry, but I don't think they need the support of major CAs for what they're doing at the moment.
  - sandGorgon 11y ago
    I meant the cross signing. That is the big deal here. And I somehow have this nagging feeling that they were strong armed into the 3 month renewal policy. No other reason to not have yearly renewals. Even if they do get into Browser roots now, there are hundreds of millions of mobile devices out there that will not accept Letsencrypt without a cross sign. Lets face it Letsencrypt is dead in the water without Identrust (or someone similar). Its not a bug, it's a feature.
    - vetrom 11y ago
      As mentioned in the other threads, 3 month renewal provides a smaller risk window for compromised domains/certificates. This is important, considering that certificate revocation is not a universally solved problem, and that Let's Encrypt is aiming to radically increase the amount of certificate issues as a whole. No strongarming necessary, I'm pretty sure technical considerations ruled the day here.

Given that Let's Encrypt is free, is there any reason why someone would use paid service for SSL certificates?

by jsnk 11y ago

Given that Let's Encrypt is free, is there any reason why someone would use paid service for SSL certificates?

dtnewman 11y ago

If it integrates easily with AWS and the price is low, I would definitely take advantage of this.

dexterdog 11y ago
The price is very low. It's as low as they can go.

peterhadlaw 11y ago

So Let's Encrypt - awesome. On a side note, I was wondering what the difference is between the base certs issued by LE vs. those fancy super, extra double / triple level certs ("EV"? if I recall) practically speaking.

givehimagun 11y ago
LE enables Domain Validated certs...so you'll get a green lock in most browsers. The Extended Validation certs gives you the green lock AND the name of the organization. The EV assures you that the company you're doing business with has been vetted...but customers don't know and most have not been educated about the differences in encryption and trust.
cookiecaper 11y ago
The gimmick on the super fancy certs that give the big green bar w/ company name next to the URL is that they supposedly mean the CA has done a super thorough investigation on the company and verified that they really are who they say they are. Those certs cost like $1k from most vendors. This could be valuable if you get a lot of people trying to imitate your company or domain; for example, something like nikeshoes.com v. nike.com. But since most customers don't actually know any difference, the practical value is very small. By contrast, a normal SSL cert is issued just by confirming control of one of the domain's email addresses.
evook 11y ago
In memory of Honest Achmed there is none. And that comes from someone who works for a company that is a CA.
- deleted 11y ago
  [deleted]
nailer 11y ago
TLDR: Whether someone checks who you are or not. Technically, it's the the difference between the baseline requirements (for all certs) and the EV requirements (required only for EV), which are at https://cabforum.org/wp-content/uploads/EV-V1_5_7.pdf https://cabforum.org/wp-content/uploads/EV-V1_5_7.pdf. In order to get an EV cert, you must pass those requirements, specifically: - government information sources - qualified independent information sources - all domain names must be inspected by a human - phone calls to your office Additionally Google mandates Certificate Transparency for EV, so all EV certs have CT as a result. EV is also required for .onion services, because what would be the point of anonymity unless you actually knew who you were talking to. In the 90s it took a long a long time for certs to be issued: you'd fax ID to VeriSign, they'd verify your identity and sign your certificate. DV was introduced by Geotrust as a way of saving money for CAs: DV just means you can register a domain: even if the domain seems like it belongs to a particular legal entity, DV makes no assurances that it does. People can and do get DV certs that seem like they're for major companies all the time. The process is entirely automated, and nobody is asserting any identity: https://google.com.mg https://google.com.mg and https://google.com.im https://google.com.im exist, they're not Google, and that's fine because DV certs don't assert identity. EV does actually assert a connection between the certificate and a specific legal identity, which is encoded in the certificate, signed and displayed in the browser. EV isn't perfect: you could attempt to be verified as another company. However it is the only type of certificate that assures an actual identity to browsers. Disclaimer: I work for a startup that's created significantly faster, more painless EV validation. We think it's important that Alice knows she's talking to Bob.

eknkc 11y ago

I recently needed a cert and got one from letsencrypt. Haven't read about them or followed all the news. I have no idea about the architecture of Let's Encrypt. So these might sound stupid; - Why do we need a local client app to issue certificates? Is there a web interface in development? Is there a technical reason for it to work this way? - Why does it issue 3 month certs? Beta period? (This is reason enough to pay btw, If I did not screw something up to end up with short term certs)

mordocai 11y ago
It gives 3 month certs because what you are supposed to be doing is automating the cert creation and when you have it automated 3 months certs are a good thing since it is a security benefit and has no disadvantages.
TazeTSchnitzel 11y ago
> Why do we need a local client app to issue certificates? So it can verify domain ownership automatically. > Why does it issue 3 month certs? Because it verifies domain ownership automatically.
- serge2k 11y ago
  Well, that and they didn't do DNS based validation first. I guess they have that now.
  - deleted 11y ago
    [deleted]
ianlevesque 11y ago
They want you to automate renewals.
herge 11y ago
I suspect the 3 month certs is to make sure you have to authenticate your domain 4 times a year with Let's Encrypt to make sure that you can't hold a valid SSL key for the domain for more than a few months after you transfer it. Also, if someone manages to scam Let's Encrypt, the resulting cert is only valid for a short time. The local client is there to make sure that the authentication process can be automated and not require your manual intervention.

falcolas 11y ago

EV and wildcard certs, IMHO. ACM is offering the latter, and not the former.

nikolay 11y ago
With ELB, in most of my projects wildcard certificates are a must and thus Let's Encrypt is not an option. I hope one day (soon) they implement that as well.

Alex3917 11y ago

A 3-year wildcard cert from rapidSSL is only 200 bucks when purchased through a reseller. If going in that direction saves you even a couple hours over the course of three years, it's more than paid for itself.

dexterdog 11y ago
200 is pretty steep for a cert IMO
serge2k 11y ago
Great. Now what happens when you have to do a rotation because of another attack that makes it possible to leak private keys?
- tombrossman 11y ago
  You generate a new CSR + private key and reissue the cert through the vendor. All the ones I've purchased allow reissuing as often as you like. The expiration date never changes obviously, but reissuing is a common practice.
  - serge2k 11y ago
    I was referring to the time spent doing something like that and the delay in response because of a lack of automation around rotating certs.

sandGorgon 11y ago

I have nurtured the secret belief that the reason that Letsencrypt renews certificates ("automatically") every three months is not a feature... but a forced limitation by the guys who own the root cert chain. If I'm a startup, why should I shirk away from paying 9.99 for a RapidSSL certificate from namecheap and have it working reliably through Ansible/Puppet/Docker... and rather muck about with the chance that my server SSL cert may go down because my letsencrypt client was outdated or something. Or worse, I have a wordpress site running on a PHP host - the best case scenario is that they agree to use a certificate I buy. Running a python based client ?

bearbin 11y ago
The LetsEncrypt root is in-house, not third party. Certificates are also cross-signed by IdenTrust, but once the LetsEncrypt root is in all major browsers, it won't be necessary to have a cross-signature. That's not to say that they don't have some other motive for the 90 day expiry, but I don't think they need the support of major CAs for what they're doing at the moment.
- sandGorgon 11y ago
  I meant the cross signing. That is the big deal here. And I somehow have this nagging feeling that they were strong armed into the 3 month renewal policy. No other reason to not have yearly renewals. Even if they do get into Browser roots now, there are hundreds of millions of mobile devices out there that will not accept Letsencrypt without a cross sign. Lets face it Letsencrypt is dead in the water without Identrust (or someone similar). Its not a bug, it's a feature.
  - vetrom 11y ago
    As mentioned in the other threads, 3 month renewal provides a smaller risk window for compromised domains/certificates. This is important, considering that certificate revocation is not a universally solved problem, and that Let's Encrypt is aiming to radically increase the amount of certificate issues as a whole. No strongarming necessary, I'm pretty sure technical considerations ruled the day here.