No predatory pricing (StartSSL has $25 revocations), free (AlphaSSL) and user-friendly (StartSSL is a UX nightmare). PositiveSSL is probably the cheapest, well supported cert (certs can be had for $3-4/y).
I've bought from the below, there are other resellers around the same price (Namecheap being one). IIRC, they routinely have 20+% codes which get you to $4/y.
Because it includes a script you can just run and will take care of everything for you, and you'll have properly TLS-configured web servers with valid certificates and reissues with a single command.
No sane system administrator is going to run a root-privilege program to reconfigure his web server and set-up SSL:
The Let’s Encrypt client is essentially an operating system component. Generically, it requires root privileges to bind to port 443 and (if requested) to reconfigure your webserver for certificate installation and renewal
That also seems like a perfect compromise vector for bad actors to modify the client software.
The Let's Encrypt effort is noble and definitely required but I think they would have been better-focused and quicker to market had they concentrated on establishing themselves as a CA first and leaving the 'auto-configuration magic' to a later stage, for the small subset of users who want that.
I don't understand how this is any worse than any other of the thousands of pieces that you run on your server. If you audit the code and it looks fine, and it's coming signed from a trusted source, what's the problem? It's not even a daemon, it just runs for a few seconds and exits.
Automatic enrollment and renewal means that it's not a maintenance burden to have certificates that are valid for weeks rather than years. Short lived certificates reduce the cost of a certificate compromise and increase the security of the internet as a whole.
Comments
Can someone summarize why this is better than, say, StartSSL or AlphaSSL?
No predatory pricing (StartSSL has $25 revocations), free (AlphaSSL) and user-friendly (StartSSL is a UX nightmare). PositiveSSL is probably the cheapest, well supported cert (certs can be had for $3-4/y).
Looks like the free offer from AlphaSSL is no more:
https://www.alphassl.com/ssl-certificates/free-ssl-certifica...
Sorry, I meant free ([unlike] AlphaSSL])
Are you sure about that $3-4 price point? The cheapest I'm seeing on their site is $49/yr.
I've bought from the below, there are other resellers around the same price (Namecheap being one). IIRC, they routinely have 20+% codes which get you to $4/y.
[1] https://cheapsslsecurity.com/comodo/positivessl.html
Namecheap sells PositiveSSL certs for $9, I'm sure others are in that price range as well.
Because it includes a script you can just run and will take care of everything for you, and you'll have properly TLS-configured web servers with valid certificates and reissues with a single command.
No sane system administrator is going to run a root-privilege program to reconfigure his web server and set-up SSL:
The Let’s Encrypt client is essentially an operating system component. Generically, it requires root privileges to bind to port 443 and (if requested) to reconfigure your webserver for certificate installation and renewal
That also seems like a perfect compromise vector for bad actors to modify the client software.
The Let's Encrypt effort is noble and definitely required but I think they would have been better-focused and quicker to market had they concentrated on establishing themselves as a CA first and leaving the 'auto-configuration magic' to a later stage, for the small subset of users who want that.
I don't understand how this is any worse than any other of the thousands of pieces that you run on your server. If you audit the code and it looks fine, and it's coming signed from a trusted source, what's the problem? It's not even a daemon, it just runs for a few seconds and exits.
Automatic enrollment and renewal means that it's not a maintenance burden to have certificates that are valid for weeks rather than years. Short lived certificates reduce the cost of a certificate compromise and increase the security of the internet as a whole.