this post was submitted on 12 Sep 2024

104 points (97.3% liked)

Selfhosted

39253 readers

258 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago

MODERATORS

[email protected]

104

Paid SSL vs Letsencrypt (lemmy.ml)

submitted 1 week ago by [email protected] to c/[email protected]

110 comments fedilink hide all child comments

I'm curious what the benefits are of paying for SSL certificates vs using a free provider such as letsencrypt.

What exactly are you trusting a cert provider with and what are the security implications? What attack vectors do you open yourself up to when trusting a certificate authority with your websites' certificates?

In what way could it benefit security and/or privacy to utilize a paid service?

And finally, which paid SSL providers are considered trustworthy?

I know Digicert is a big player, but their prices are insane. Comodo seems like a good affordable option, but is it a trustworthy company?

top 50 comments

sorted by: hot top controversial new old

[–] [email protected] 10 points 6 days ago (1 children)

The main benefits to paying for certs are

as many said, getting more than 90 days validity for certs that are harder to rotate, or the automation hasn't been done.
higher rate limits for issuing and renewing certs, you can ask letsencrypt to up limits, but you can still hit them.
you can get certs for things other than web sites, ie code signing.

The only thing that matters to most people is that they don't get cert errors going to/using a web site, or installing software. Any CA that is in the browsers, OS and various language trust stores is the same to that effect.

The rules for inclusion in the browsers trust stores are strict (many of the Linux distros and language trust stores just use the Mozilla cert set), which is where the trust comes from.

Which CA provider you choose doesn't change your potential attack surface. The question on attack surface seems like it might come from lacking understanding of how certs and signing work.

A cert has 2 parts public cert and private key, CAs sign your sites public cert with their private key, they never have or need your private key. Public certs can be used to verify something was signed by the private key. Public certs can be used to encrypt data such that only the private key can decrypt it.

[–] [email protected] 2 points 5 days ago* (last edited 5 days ago) (1 children)

OP's security concern is valid. Different CAs may differ in the challenges used to verify you to be the domain owner. Using something that you could crack may lead to an attacker's public key being certified instead.

This could for example be the case with HTTPS verification (place a file with a specific content accessible through your URL) if the website has lacking input sanitization and/or creates files with the user's input at an unfortunate location that collides with the challenge.

This attack vector might be far-fetched, but there can certainly be differences between different signing authorities.

[–] [email protected] 7 points 5 days ago (2 children)

But even if you use GoMommy extra super duper triple snake oil security checked ssl cert, if I trick LetsEncrypt to sign a key for that domain I still have a valid cert for your site.

[–] [email protected] 1 points 4 days ago* (last edited 4 days ago)

Certificate pinning?

Also all let's encrypt certs are public. So if someone malicious gets a cert for your domain, you can notice.

(Thats also why it may be a bad idea to use that for secretButPublicStuff.Yourdomain.com certificate transparency logs are a great way to find attack surface.)

edit oh certificate pinning has been deprecated in favor of checking transparency logs.

[–] [email protected] 3 points 5 days ago

You're right, my bad.

[–] [email protected] 9 points 6 days ago* (last edited 6 days ago) (1 children)

The point of paid SSL at this stage in the game are the higher tiers of verification. Instead of just verifying that you own the domain, you can verify that you are who you say you are. These are called Extended Validation and Organizational Validation certificates. This has historically been desirable by businesses. It used to be that these higher tier certs would not only give you a lock icon in the address bar of a web browser, but also a little blurb confirming your organization is legit. Not sure if this is still the case though. You will see the extended validation when you check the sites certificate though for sure.

As far as encryption and security, there’s no difference. Also side note, the Comodo brand still technically exists but it was bought by Sectigo like 7 years ago.

[–] [email protected] 12 points 6 days ago (1 children)

I'm pretty sure browsers stopped distinguishing EV certificates years ago.

[–] [email protected] 5 points 6 days ago

I think you are right but I wasn’t sure. Like technically you’ll still see the details if you open the certificate but… who’s doing that?

[–] [email protected] 15 points 6 days ago (1 children)

Worked as a sysadmin for years dealing with all kinds of certificates. Liek others have said if you can't automate the process a paid certificate buys you 12 months at a time in validity. Also wildcard certificates are more difficult to do automated with let's encrypt. If you want EV certificates (where the cert company actually calls you up and verifies you're the company you claim to be) you also need to go the paid route

In my experience trustworthyness of certs is not an issue with LE. I sometimes check websites certs and of I see they're LE I'm more like "Good for them"

[–] [email protected] 11 points 6 days ago (1 children)

Also wildcard certificates are more difficult to do automated with let's encrypt.

They are trivial with a non-garbage domain provider.

If you want EV certificates (where the cert company actually calls you up and verifies you're the company you claim to be) you also need to go the paid route

The process however isn't as secure as one might think: https://cyberscoop.com/easy-fake-extended-validation-certificates-research-shows/

In my experience trustworthyness of certs is not an issue with LE. I sometimes check websites certs and of I see they're LE I'm more like "Good for them"

Basically, am LE cert says "we were able to verify that the operator of this service you're attempting to use controls (parts of) the domain it claims to be part of". Nothing more or less. Which in most cases is enough so that you can secure the connection. It's possibly even a stronger guarantee than some sketchy cert providers provided in the past which was like "we were able to verify that someone sent us money".

[–] [email protected] 3 points 6 days ago (1 children)

Having a non-garbage domain provider can be a luxury. I used to work at a place where we were paying boatloads of money for certificates from Sectigo for internal services, and they were charging us extra per additional name and even more if we wanted a wildcard, even though it didn't cost them anything to include those options. Getting IT to set up the DNS records for Let's Encrypt DNS verification was never going to happen.

[–] [email protected] 1 points 6 days ago

I was also with a provider that didn't offer API access for the longest time. When they then increased prices, I switched, now paying a third of their asking price per year at a very good provider.

I guess migrating is difficult if the provider doesn't offer a mechanism to either dump the DNS to a file or perform a zone transfer (the later being part of the standard).

Can only recommend INWX for domains, though my personal requirements aren't the highest.

load more comments