Apologize for posting in the wrong section or even the wrong place entirely - I don’t know where else to go.
My issue:
I am moving my websites to HTTPS and found one of my hosting providers, Protagonist (NL), to not support Let’s Encrypt. They do offer SSL certificates for a yearly fee and told me, by phone, today:
“We do not offer Let’s Encrypt because it is unsafe. Google will stop support for it in July of this year.”
They are going to make me an offer for a discounted price for their certificates after I told them I am going to move my sites to another host (that does support Let’s Encrypt).
I then started searching online for information about this (LE being unsafe, Google no longer supporting free SSL as being safe, etc.) but could not find anything other than some rumor that Apple is not supporting LE anymore - which, if you read the information, seems to be based on assumptions, at best.
So my question would be: is there any truth in Let’s Encrypt being usafe (or free SSL in general) and Google ending support for it in July of 2018?
There are some changes going on with trust though, mainly around Symantec:
Starting with Chrome 66, Chrome will remove trust in Symantec-issued certificates issued prior to June 1, 2016. Chrome 66 is currently scheduled to be released to Chrome Beta users on March 15, 2018 and to Chrome Stable users around April 17, 2018.
In July, Chrome will start marking sites with no TLS/SSL at all as "insecure", but that certainly does not affect sites protected by Let's Encrypt certificates.
I indeed found the issue with Symantec, and know about the big G doing some changes in July of 2018 towards non-SSL sites. I found it to be very weird that Chrome, Google’s browser, being a supporter of LE and then stopping to trust it in July of 2018 alltogether.
I am going to search for an official statement by Google that they fully support LE and I will send this to my host. If you have a good source for me to link to, I would be very happy to slap my host with it.
I don’t know if there are any good links. Google might have written something by coincidence, but they don’t take the time to deny every false rumor. They probably haven’t heard it at all.
I could say Google was going to destroy the Moon, and you probably won’t be able to find a Google blog post denying it…
Ha yes good point. But: Google claiming they DO trust LE SSL would be very helpful too. Them supporting LE is great, but a statement about it would be better.
Google Chrome remains a Platinum sponsor of Let’s Encrypt in 2017, and has committed to continue that support next year.
I personally wouldn't bother. Your host is clearly run by a bunch of thugs that are trying to sell their expensive certificates by lying to their customers.
Yes I asked them, after reading your comments (and replies on Google Product Forums) to send me a link where I can read about Google not trusting LE certificates (I asked them for their source).
You would not be surprised if I told you I haven’t had a response to that message yet…
Well, the story continues. The hosting provider replied to my request for the source of the given information (the following is a translation of what was written):
"It was a mistake to say Google is no longer supporting LE as of July, however, the difference between Let’s Encrypt and a paid-for certificate is that the paid-for certificates do a domain check: they check if the certificate is applied forby the holder of the domain.
Let’s Encrypt does not do this. The check for domain name holder is an extra factor for reliability of the certificate. In other words: if someone as an individual registers a domain with an anonymous e-mail address (for example Hotmail or Gmail) en puts an SSL certificate on it then the traffic is encrypted but the https-address says nothing about the holder of the domain name. In theory this could be a criminal.
As stated before we do not support Let’s Encrypt."
I would like to kindly ask you here on the help forums: is this statement true? Does LE not do a domain-check and is therefore potentially less safe? And if so: why would the likes of Google and Cisco (and all the other sponsors of LE) want to be associated with this potentially ‘unsafe’ method?
No. Let's Encrypt, like every other trusted CA, validates that the person requesting a cert has control over the domain name(s) for which they're requesting a cert. This kind of FUD from competing CAs/hosts isn't new; here are some other discussions on related issues:
It wasn't a "mistake", it was a lie. Your host is lying to you. When caught in that lie, they've shifted to another one. When you catch them in that lie, no doubt they'll shift to a third. It's a pity more people won't vote with their wallets to penalize abusive businesses like this.
Your host is afraid it will lose income. In trying to protect their revenue, they will tell you anything that puts Let's Encrypt in a bad image.
For every lie they tell you, ask them for proof. For example, for the last one, many paid CA's do exactly the same thing as Let's Encrypt: they just confirm with some token the requesting party has control over a domain name/host name. For DV certificates, no human interaction is required at all, even for paid certificates.
This is true of certificates issued by Let's Encrypt--LE validates that the requestor has control over the domain, but they do nothing to validate the identity (much less the good faith) of the requestor**. This is also true of DV certificates issued by anyone else, whether paid or free. DV certs are fine for a lot of folks (including major Internet businesses like Google and Amazon), but they don't validate that the identity of the owner. A fairly good explanation of the difference is here: https://certsimple.com/blog/are-ev-ssl-certificates-worth-it
But it's worth repeating, and emphasizing, that this is true of any DV cert, whether you paid for it or not, whether it was issued by Let's Encrypt or Comodo, etc. None of them validate the identity of the owner, because they simply aren't designed to.
** I don't believe it's for the CA to attempt to certify the bona fides of its users; LE and Comodo appear to disagree on this, though LE's position doesn't go as far as I'd wish. But here's their position:
I think the host is confusing DV, OV, and EV certificates here. There are other kinds of validations, that Let's Encrypt doesn't do, where an offline validation of the applicant's entity is performed. The CA will then contact the applicant in the physical world and/or verify identity documents submitted by the applicant. After doing this, the CA will put information about the applicant's offline identity into the certificate.
In the DV certification style, which Let's Encrypt does, the verification is all online and is only aimed at checking that the applicant has control of the domain, without also checking who the applicant is in another way.
DV has been criticized because someone who obtains apparent control of a domain illicitly can get a certificate, and someone who creates a site that's confusingly similar to an existing site can get a certificate (although this latter issue turns out to be true for EV as well, as long as the submitted identity documentation is correct on its own terms). DV also makes it easier for people to run sites anonymously, which can be viewed both positively and negatively by various people in various contexts.
Let's Encrypt's certificates are available free of charge in large part because DV can be completely automated, so there's almost no marginal cost to Let's Encrypt in performing an additional automated verification. Let's Encrypt's fixed costs for infrastructure and staff can then be paid up-front by sponsorships and donations, and the total costs don't increase rapidly as the certificate volume grows.
As several other people in this thread have mentioned, most paid CAs also do DV, performing the same kind of verification as Let's Encrypt does, by the same methods. Currently OV and EV certificates are only available from paid CAs, but that doesn't mean that all paid certificates are OV or EV.
There's no difference in cryptographic security between these types of certificate; users' connections are protected by the same encryption technologies. The difference is only in the identity information contained in the certificate and how it was checked.
I am not persuaded that your host is deliberately misleading you, but nonetheless both of the explanations that you've been given have been inaccurate.
I would suggest shopping for a new hosting provider. You could try Linode which is a VPS provider, and they have a PoP in UK, which is somewhat close to NL.
