Selfhosted

AFAIK, the only reason not to use Letsencrypt are when you are not able to automate the process to change the certificate.

As the paid certificates are valid for 12 month, you have to change them less often than a letsencrypt certificate.

At work, we pay something like 30-50€ for a certificate for a year. As changing certificates costs, it is more economical to buy a certificate.

But generally, it is best to use letsencrypt when you can automate the process (e.g. with nginx).

As for the question of trust: The process of issuing certificates is done in a way that the certificate authority never has access to your private key. You don't trust the CA with anything (except your payment data maybe).

Why?

Let's encrypt is free and secure. There is no good reason not to use it.

With paid certificates you can target ancient and unsupported operating systems like windows XP and android 2, letsencrypt is relatively recent and it's not present in the root certificates of those systems

So, the web uses a system called chain of trust. There are public keys stored in your system or browser that are used to validate the public keys given to you by various web sites.

Both letsencrypt and traditional SSL providers work because they have keys on your system in the appropriate place so as to deem them trustworthy.

All that to say, you're always trusting a certificate authority on some level unless you're doing self signed certificates... And then nobody trusts you.

The main advantage to a paid cert authority is a bit more flexibility and a fancier certificate for your website that also perhaps includes the business name.

Realistically... There's not much of a benefit for the average website or even small business.

Certain unnamed companies cough~google~ doesn’t like to trust Let Encrypt its definitely not an abuse of an illegal monopoly they have good reasons I promise.

But the whole point behind using a signed certificate is that other people can look at you and immediately know you are who you say you are if a company doesn’t trust you it doesn’t really matter what the motivation is you might as well use a self signed certificate.

Paid certificates have the money to make sure everyone trusts them and has a reputation to maintain so are more likely to defend a legitimate complaint.

99.999% of individuals it simply doesn’t matter(although you might have to look into it if you’re using android apps) but to a company the little bit that certification costs is worth every penny.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

9 acronyms in this thread; the most compressed thread commented on today has 7 acronyms.

[Thread #969 for this sub, first seen 12th Sep 2024, 15:05] [FAQ] [Full list] [Contact] [Source code]