Which certificate is appropriate for a small WordPress WooCommerce shop?

  • If you are happy with my answer please can you accept it. This question has been left unanswered for a long time now. Thank you. Mar 24 '17 at 11:36

A standard SSL certificate will do the same job at encrypting communications between the server and client whether the certificate authority has provided it for a fee or for free, and either could be considered appropriate however it is worth noting that as with any SSL certificate, you will need to ensure your server and website are configured to use it properly, and that you update the certificate whenever there are updates to supported protocols and ciphers etc.

If you are not already familiar with installing SSL certificates you may appreciate paying a fee so that you can receive associated support as may be required to help you get started.

Additionally, Let's Encrypt SSL certificates are valid for 90 days, where typically other certificate authorities provide a certificate valid for 365 days. If you are not able to automate the certificate renewal/issuance process on your server then this will mean much more manual work for you to get and keep the SSL certificate installed correctly. The 90 days validity is deliberate on their part to encourage automation since shorter certificate lifes minimise risk.

Ref: Let's Encrypt: Why ninety-day lifetimes for certificates?


I think this question might come down to opinions rather than facts. But given the little research that I just carried out, it seems that Let's Encrypt may already be under abuse (see below ref).

Also, Let's Encrypt appears to be purely for encryption. Whereas services like RapidSSL offer a level of warranty for any SSL Failure.

For peace of mind, I would not go with Let's Encrypt because of these brief findings.

Abuse Article: http://blog.trendmicro.com/trendlabs-security-intelligence/lets-encrypt-now-being-abused-by-malvertisers/

  • 3
    This answer is misleading - the article referred to does not infer that Let's Encrypt are under abuse, but simply that malicious websites are using free SSL certificates as well as legitimate websites (which is to be expected), and this is not really any different to malicious websites using domain names or hosting as well as legitimate websites. Let's Encrypt will obviously try to some extent to prevent and minimise the use of their SSL certificates for malicious purposes. Similarly, bad guys drinking coffee doesn't mean coffee is bad. Sep 13 '16 at 11:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.