3 ms·

In this case it looks like their OCSP servers are down as well though. I think the validity period for OCSP responses is a bit shorter than 7 days. Even ignori

In this case it looks like their OCSP servers are down as well though. I think the validity period for OCSP responses is a bit shorter than 7 days. Even ignoring that, 7 days is a rather short period of time for such a large portion of the web to migrate to another CA if that were to become necessary for whatever reason. IMO having another free, independently operated ACME CA would be ideal, particularly if it could support having built-in fail-over added to ACME clients as a default setting.

coder543 5y ago
> IMO having another free, independently operated ACME CA would be ideal Did you see this comment? https://news.ycombinator.com/item?id=27885851 https://news.ycombinator.com/item?id=27885851
- Ajedi32 5y ago
  Obviously yes; it's in the comment chain I'm replying to. ZeroSSL is good, but AFAIK its free tier[1] doesn't support everything Let's Encrypt does (like wildcard certs) which makes it difficult to use as a drop-in replacement for many people. [1]: https://zerossl.com/pricing/ https://zerossl.com/pricing/
  - gsich 5y ago
    True, but my guess is that most certificates are not wildcards.
  - terom 5y ago
    Their pricing page seems to be a little confusing, but [1] does state that wildcard certs issued via ACME are free of charge. The SSL.com [2] pricing model, OTOH... > By using ZeroSSL's ACME feature, you will be able to generate an unlimited amount of 90-day SSL certificates at no charge, also supporting multi-domain certificates and wildcards. Each certificate you create will be stored in your ZeroSSL account. [1] https://zerossl.com/documentation/acme/ https://zerossl.com/documentation/acme/ [2] https://community.letsencrypt.org/t/is-ssl-coms-acme-really-free/154463/3 https://community.letsencrypt.org/t/is-ssl-coms-acme-really-...
Arnavion 5y ago
Their OCSP servers have always been spotty. OCSP stapling helps guard against that, at least.

coder543 5y ago

> IMO having another free, independently operated ACME CA would be ideal Did you see this comment? https://news.ycombinator.com/item?id=27885851 https://news.ycombinator.com/item?id=27885851

Ajedi32 5y ago
Obviously yes; it's in the comment chain I'm replying to. ZeroSSL is good, but AFAIK its free tier[1] doesn't support everything Let's Encrypt does (like wildcard certs) which makes it difficult to use as a drop-in replacement for many people. [1]: https://zerossl.com/pricing/ https://zerossl.com/pricing/
- gsich 5y ago
  True, but my guess is that most certificates are not wildcards.
- terom 5y ago
  Their pricing page seems to be a little confusing, but [1] does state that wildcard certs issued via ACME are free of charge. The SSL.com [2] pricing model, OTOH... > By using ZeroSSL's ACME feature, you will be able to generate an unlimited amount of 90-day SSL certificates at no charge, also supporting multi-domain certificates and wildcards. Each certificate you create will be stored in your ZeroSSL account. [1] https://zerossl.com/documentation/acme/ https://zerossl.com/documentation/acme/ [2] https://community.letsencrypt.org/t/is-ssl-coms-acme-really-free/154463/3 https://community.letsencrypt.org/t/is-ssl-coms-acme-really-...

Arnavion 5y ago

Their OCSP servers have always been spotty. OCSP stapling helps guard against that, at least.