Timeline for Why should I pay for an SSL certificate?
Current License: CC BY-SA 4.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 18, 2019 at 11:12 | comment | added | gbjbaanb | @StephenOstermiller not even that soon, they're going away completely | |
| Aug 17, 2019 at 17:07 | comment | added | Stephen Ostermiller♦ | @gbjbaanb Firefox displays EV certificates differently. It shows the whole organization name in green letters between the lock icon and the URL. Here is a Mozilla blog post with examples: blog.mozilla.org/security/2015/11/03/… | |
| Aug 17, 2019 at 13:48 | comment | added | gbjbaanb | "n practice, browsers only give a visual nod to EV certs" - right at the top, webmasters.stackexchange.com - verified by Lets Encrypt - shown as a nice green lock (on my firefox browser at least). ie, DV certs are highlighted too. | |
| Aug 17, 2019 at 8:31 | history | edited | Stephen Ostermiller♦ | CC BY-SA 4.0 |
Add more about trust due to cert levels
|
| Aug 17, 2019 at 0:04 | comment | added | marcelm | "Up to this point, most users don't know or care about the different validation levels." - Which makes them pretty pointless. If users don't distinguish EV/DV certs, an attacker who obtains a valid DV cert for some domain can carry out MITM attacks on that domain, even if the original site has an EV cert. | |
| Aug 17, 2019 at 0:01 | comment | added | marcelm | "The better your certificate, the more your site can be trusted." - Certificates only give some level of guarantee that you're actually and confidentially talking to the hostname your browser displays. They tell you nothing about whether or not that site can be trusted. | |
| Aug 16, 2019 at 17:10 | comment | added | Patrick Mevzek | @Eight At some points browsers also started to display website with EV certificate differently. Which does not change anything how they work under, they use the exact same cryptographic materials, primitives and algorithms than any other certificates, including DV and OV ones. | |
| Aug 16, 2019 at 16:59 | comment | added | Patrick Mevzek | "LetsEncrypt only offer the lowest validation type of certificate. [..] The better your certificate, the more your site can be trusted." This is hugely a matter of personal preference and not an universal truth. And it mostly does not matter because of the current Web PKI it is the security of the lowest secured CA in your trust store that defines the security of the whole ecosystem.. until everyone uses CAA+DNSSEC on their domains, and all CAs use at least DNSSEC during validation and multiple vantage points. | |
| Aug 16, 2019 at 16:57 | comment | added | Patrick Mevzek | @Eight Different checks and different end results too: a DV certificate identify an hostname, an OV/EV certificate identify an entity. Also CAB Forum requirements put different constraints, you can not have an EV for 3 years for example, nor for wildcards. | |
| Aug 16, 2019 at 16:55 | comment | added | Patrick Mevzek | "LetsEncrypt certificates only last 3 months." it is done on purpose and not seen as a drawback but a positive things in fact. | |
| Aug 16, 2019 at 16:09 | comment | added | Leonardo Petrucci | Is there any actual functional difference between DV and OF/EV? Or is it literally just a more thorough check? | |
| Aug 16, 2019 at 15:55 | history | edited | Stephen Ostermiller♦ | CC BY-SA 4.0 |
added 583 characters in body
|
| Aug 16, 2019 at 15:50 | history | answered | Stephen Ostermiller♦ | CC BY-SA 4.0 |