3 ms·
The good news is that the CAs signed their own death warrant with this change. If switching to ACME is more or less mandatory, what purpose do paid certificates
by bigbuppo 10mo ago
The good news is that the CAs signed their own death warrant with this change. If switching to ACME is more or less mandatory, what purpose do paid certificates serve? Your options are to use LE, switch to non-CA-issued encryption, or drop encryption entirely.
- xg15 10mo agoNew web features are https-only by default, since a few years ago. So if your site uses any recent APIs, dropping encryption is not an option.
- zozbot234 10mo agoSecure context is only required for features that are somehow privacy- or security-sensitive. Some notable features are on the list, but you can absolutely have a modern site that doesn't rely on any of these.
- manindahat 10mo agoSecuring your communications is required to mitigate against main in the middle attacks.
- nickf 10mo agoYou assume it’s just the certs being purchased - and not support, SLAs, other related products, management platforms, private PKI and more. If all you do is public TLS, sure, that might be an issue.
- briHass 10mo agoPaid certs are valid for 1-year from the $$ CAs. LE certs are only good for ~3-4 months before they have to be reissued. If there's no easy way to do an automated ACME setup to handle the renewal, being able to defer that for a year is worth the $20 or $70 for a wildcard. If paid certs drop in max validity period, then yeah, zero reason to burn money for no reason.
- piperswe 10mo agoThe $$ CAs will soon only issue 45-day certs, because that's all that browsers will accept.
- deleted 10mo ago[deleted]