4 ms·

FWIW I recently had to switch to ZeroSSL from Letsencrypt which I normally use, while porting a backend from AWS (that used their certs) to a local server, as t

FWIW I recently had to switch to ZeroSSL from Letsencrypt which I normally use, while porting a backend from AWS (that used their certs) to a local server, as the IoT gear from 2016 we're supporting didn't have the root certs that validating LE certs required (this was related to the 2021 expiration of the R3 root cert I think it was that LE used). It was kind of an eye-opener that you could potentially brick a whole fleet of sold products by a cert expiring. In this case it was no real problem as other providers had certs with valid root certs.

mananaysiempre 3y ago
When SHA-1 was being phased out, there was a lot of whining on mozilla.dev.security.policy from CAs who had issued SHA-1 certs installed into medical and point-of-sale systems with no real update options, then continued to issue them well after the dates that the CA/Browser forum voted on. I thought everybody realized at that time that using the Web PKI and having no way to push updates are mutually exclusive, but guess not.