# Hosting provider claims LE is unsafe en Google will stop support in July 2018 **URL:** \ **Category:** Server\ **Created:** [February 13, 2018, 9:49am UTC](https://community.letsencrypt.org/t/hosting-provider-claims-le-is-unsafe-en-google-will-stop-support-in-july-2018/52971 "2018-02-13T09:49:14Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Frits](https://avatars.discourse-cdn.com/v4/letter/f/85f322/32.png) [@Frits](https://community.letsencrypt.org/u/Frits)\ **Post date:** [February 13, 2018, 9:49am UTC](https://community.letsencrypt.org/t/hosting-provider-claims-le-is-unsafe-en-google-will-stop-support-in-july-2018/52971/1 "2018-02-13T09:49:14Z")
Hi, Apologize for posting in the wrong section or even the wrong place entirely - I don’t know where else to go. My issue: I am moving my websites to HTTPS and found one of my hosting providers, Protagonist (NL), to not support Let’s Encrypt. They do offer SSL certificates for a yearly fee and told me, by phone, today: “We do not offer Let’s Encrypt because it is unsafe. Google will stop support for it in July of this year.” They are going to make me an offer for a discounted price for their certificates after I told them I am going to move my sites to another host (that does support Let’s Encrypt). I then started searching online for information about this (LE being unsafe, Google no longer supporting free SSL as being safe, etc.) but could not find anything other than some rumor that Apple is not supporting LE anymore - which, if you read the information, seems to be based on assumptions, at best. So my question would be: is there any truth in Let’s Encrypt being usafe (or free SSL in general) and Google ending support for it in July of 2018? ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [February 13, 2018, 10:02am UTC](https://community.letsencrypt.org/t/hosting-provider-claims-le-is-unsafe-en-google-will-stop-support-in-july-2018/52971/2 "2018-02-13T10:02:10Z")
How odd it is for Google to [be a top tier sponsor of Let's Encrypt](https://letsencrypt.org/sponsors/) while simultaneously not supporting it. Your host is full of shit. There are some changes going on with trust though, mainly around Symantec: > Starting with Chrome 66, Chrome will remove trust in Symantec-issued certificates issued prior to June 1, 2016. Chrome 66 is currently scheduled to be released to Chrome Beta users on March 15, 2018 and to Chrome Stable users around April 17, 2018. In July, Chrome will start marking sites with no TLS/SSL at all as "insecure", but that certainly does not affect sites protected by Let's Encrypt certificates. ---
**Author:** ![Frits](https://avatars.discourse-cdn.com/v4/letter/f/85f322/32.png) [@Frits](https://community.letsencrypt.org/u/Frits)\ **Post date:** [February 13, 2018, 10:35am UTC](https://community.letsencrypt.org/t/hosting-provider-claims-le-is-unsafe-en-google-will-stop-support-in-july-2018/52971/3 "2018-02-13T10:35:00Z")
Thanks a lot: your comment support my suspicions. I indeed found the issue with Symantec, and know about the big G doing some changes in July of 2018 towards non-SSL sites. I found it to be very weird that Chrome, Google’s browser, being a supporter of LE and then stopping to trust it in July of 2018 alltogether. I am going to search for an official statement by Google that they fully support LE and I will send this to my host. If you have a good source for me to link to, I would be very happy to slap my host with it. Thanks again for your quick reply! ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [February 13, 2018, 10:57am UTC](https://community.letsencrypt.org/t/hosting-provider-claims-le-is-unsafe-en-google-will-stop-support-in-july-2018/52971/4 "2018-02-13T10:57:35Z")
I don’t know if there are any good links. Google might have written something by coincidence, but they don’t take the time to deny every false rumor. They probably haven’t heard it at all. I could say Google was going to destroy the Moon, and you probably won’t be able to find a Google blog post denying it… 😓 ---
**Author:** ![Frits](https://avatars.discourse-cdn.com/v4/letter/f/85f322/32.png) [@Frits](https://community.letsencrypt.org/u/Frits)\ **Post date:** [February 13, 2018, 11:06am UTC](https://community.letsencrypt.org/t/hosting-provider-claims-le-is-unsafe-en-google-will-stop-support-in-july-2018/52971/5 "2018-02-13T11:06:41Z")
Ha yes good point. But: Google claiming they DO trust LE SSL would be very helpful too. Them supporting LE is great, but a statement about it would be better. ---
**Author:** ![slokhorst](https://avatars.discourse-cdn.com/v4/letter/s/e47774/32.png) [@slokhorst](https://community.letsencrypt.org/u/slokhorst)\ **Post date:** [February 13, 2018, 11:27am UTC](https://community.letsencrypt.org/t/hosting-provider-claims-le-is-unsafe-en-google-will-stop-support-in-july-2018/52971/6 "2018-02-13T11:27:27Z")
> Google Chrome remains a Platinum sponsor of Let’s Encrypt in 2017, and has committed to continue that support next year. > **[Say “yes” to HTTPS: Chrome secures the web, one site at a time](https://blog.google/technology/safety-security/say-yes-https-chrome-secures-web-one-site-time/)** > > A year ago we began marking all sites that are not encrypted with HTTPS as “not secure” in Chrome. As more site owners improve the security of their site, we're checking in on the progress of HTTPS usage worldwide. I personally wouldn't bother. Your host is clearly run by a bunch of thugs that are trying to sell their expensive certificates by lying to their customers. ---
**Author:** ![Patches](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/patches/32/17145_2.png) [@Patches](https://community.letsencrypt.org/u/Patches)\ **Post date:** [February 14, 2018, 2:08am UTC](https://community.letsencrypt.org/t/hosting-provider-claims-le-is-unsafe-en-google-will-stop-support-in-july-2018/52971/7 "2018-02-14T02:08:51Z")
Google also trusts Let’s Encrypt to provide certificates for their cloud customers: [https://cloud.google.com/appengine/docs/standard/python/securing-custom-domains-with-ssl#verify\_a\_managed\_certificate\_has\_been\_provisioned](https://cloud.google.com/appengine/docs/standard/python/securing-custom-domains-with-ssl#verify_a_managed_certificate_has_been_provisioned) ---
**Author:** ![jvanasco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jvanasco/32/55900_2.png) [@jvanasco](https://community.letsencrypt.org/u/jvanasco)\ **Post date:** [February 14, 2018, 2:37am UTC](https://community.letsencrypt.org/t/hosting-provider-claims-le-is-unsafe-en-google-will-stop-support-in-july-2018/52971/8 "2018-02-14T02:37:38Z")
> [@Frits](#): > > I am going to search for an official statement by Google that they fully support LE and I will send this to my host. If you have a good source for me to link to, I would be very happy to slap my host with it. first remember this quote: > [@\_az](#): > > Your host is full of shit. you should move hosts. before you move hosts, you should ask your current host to prove their (untrue) allegation. why should you have to prove an untrue thing? they should furnish you with their proof. ---
**Author:** ![Frits](https://avatars.discourse-cdn.com/v4/letter/f/85f322/32.png) [@Frits](https://community.letsencrypt.org/u/Frits)\ **Post date:** [February 14, 2018, 8:02am UTC](https://community.letsencrypt.org/t/hosting-provider-claims-le-is-unsafe-en-google-will-stop-support-in-july-2018/52971/9 "2018-02-14T08:02:53Z")
Yes I asked them, after reading your comments (and replies on Google Product Forums) to send me a link where I can read about Google not trusting LE certificates (I asked them for their source). You would not be surprised if I told you I haven’t had a response to that message yet… ---
**Author:** ![PeaceComesFree](https://avatars.discourse-cdn.com/v4/letter/p/4491bb/32.png) [@PeaceComesFree](https://community.letsencrypt.org/u/PeaceComesFree)\ **Post date:** [February 14, 2018, 8:59am UTC](https://community.letsencrypt.org/t/hosting-provider-claims-le-is-unsafe-en-google-will-stop-support-in-july-2018/52971/10 "2018-02-14T08:59:45Z")
@Frits If you need a final nudge from an unbiased fellow punter… this is it. MOVE to a reputable host ASAP. I’m very satisfied with my present hosting provider. Last year, I emailed the CEO asking for integration with LE, and received a personal reply promising to integrate LE. They are now integrated with LE so I am able to renew my ssl certificates myself for free. ---
**Author:** ![Frits](https://avatars.discourse-cdn.com/v4/letter/f/85f322/32.png) [@Frits](https://community.letsencrypt.org/u/Frits)\ **Post date:** [February 14, 2018, 1:12pm UTC](https://community.letsencrypt.org/t/hosting-provider-claims-le-is-unsafe-en-google-will-stop-support-in-july-2018/52971/11 "2018-02-14T13:12:57Z")
Well, the story continues. The hosting provider replied to my request for the source of the given information (the following is a translation of what was written): "It was a mistake to say Google is no longer supporting LE as of July, however, the difference between Let’s Encrypt and a paid-for certificate is that the paid-for certificates do a domain check: they check if the certificate is applied forby the holder of the domain. Let’s Encrypt does not do this. The check for domain name holder is an extra factor for reliability of the certificate. In other words: if someone as an individual registers a domain with an anonymous e-mail address (for example Hotmail or Gmail) en puts an SSL certificate on it then the traffic is encrypted but the https-address says nothing about the holder of the domain name. In theory this could be a criminal. As stated before we do not support Let’s Encrypt." I would like to kindly ask you here on the help forums: is this statement true? Does LE not do a domain-check and is therefore potentially less safe? And if so: why would the likes of Google and Cisco (and all the other sponsors of LE) want to be associated with this potentially ‘unsafe’ method? ---
**Author:** ![danb35](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danb35/32/70869_2.png) [@danb35](https://community.letsencrypt.org/u/danb35)\ **Post date:** [February 14, 2018, 1:28pm UTC](https://community.letsencrypt.org/t/hosting-provider-claims-le-is-unsafe-en-google-will-stop-support-in-july-2018/52971/12 "2018-02-14T13:28:16Z")
> [@Frits](#): > > is this statement true? No. Let's Encrypt, like every other trusted CA, validates that the person requesting a cert has control over the domain name(s) for which they're requesting a cert. This kind of FUD from competing CAs/hosts isn't new; here are some other discussions on related issues: > [@Namecheap Response to Let's Encrypt](https://community.letsencrypt.org/t/namecheap-response-to-lets-encrypt/51411/15): > > M… > [@What NameCheap is saying about LetsEncrypt- from a support blog](https://community.letsencrypt.org/t/what-namecheap-is-saying-about-letsencrypt-from-a-support-blog/29415): > > I… > [@Comodo Dragon browser - Possibly Missing CA Roots to Trust Let's Encrypt](https://community.letsencrypt.org/t/comodo-dragon-browser-possibly-missing-ca-roots-to-trust-lets-encrypt/45143/6): > > I… ---
**Author:** ![danb35](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danb35/32/70869_2.png) [@danb35](https://community.letsencrypt.org/u/danb35)\ **Post date:** [February 14, 2018, 1:29pm UTC](https://community.letsencrypt.org/t/hosting-provider-claims-le-is-unsafe-en-google-will-stop-support-in-july-2018/52971/13 "2018-02-14T13:29:57Z")
> [@Frits](#): > > It was a mistake to say Google is no longer supporting LE as of July It wasn't a "mistake", it was a lie. Your host is lying to you. When caught in that lie, they've shifted to another one. When you catch them in that lie, no doubt they'll shift to a third. It's a pity more people won't vote with their wallets to penalize abusive businesses like this. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [February 14, 2018, 1:34pm UTC](https://community.letsencrypt.org/t/hosting-provider-claims-le-is-unsafe-en-google-will-stop-support-in-july-2018/52971/14 "2018-02-14T13:34:18Z")
It all comes down to this: > [@Frits](#): > > They do offer SSL certificates for a yearly fee (…) Your host is afraid it will lose income. In trying to protect their revenue, they will tell you anything that puts Let's Encrypt in a bad image. For every lie they tell you, ask them for _proof_. For example, for the last one, many paid CA's do exactly the same thing as Let's Encrypt: they just confirm with some token the requesting party has control over a domain name/host name. For DV certificates, no human interaction is required _at all_, even for paid certificates. ---
**Author:** ![Frits](https://avatars.discourse-cdn.com/v4/letter/f/85f322/32.png) [@Frits](https://community.letsencrypt.org/u/Frits)\ **Post date:** [February 14, 2018, 2:15pm UTC](https://community.letsencrypt.org/t/hosting-provider-claims-le-is-unsafe-en-google-will-stop-support-in-july-2018/52971/15 "2018-02-14T14:15:52Z")
Thanks, all of you, for the replies and suggestions. ---
**Author:** ![danb35](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danb35/32/70869_2.png) [@danb35](https://community.letsencrypt.org/u/danb35)\ **Post date:** [February 14, 2018, 2:16pm UTC](https://community.letsencrypt.org/t/hosting-provider-claims-le-is-unsafe-en-google-will-stop-support-in-july-2018/52971/16 "2018-02-14T14:16:27Z")
> [@Frits](#): > > if someone as an individual registers a domain with an anonymous e-mail address (for example Hotmail or Gmail) en puts an SSL certificate on it then the traffic is encrypted but the https-address says nothing about the holder of the domain name. In theory this could be a criminal. This is true of certificates issued by Let's Encrypt--LE validates that the requestor has control over the domain, but they do nothing to validate the identity (much less the good faith) of the requestor\*\*. This is also true of DV certificates issued by anyone else, whether paid or free. DV certs are fine for a lot of folks (including major Internet businesses like Google and Amazon), but they don't validate that the identity of the owner. A fairly good explanation of the difference is here: [https://certsimple.com/blog/are-ev-ssl-certificates-worth-it](https://certsimple.com/blog/are-ev-ssl-certificates-worth-it) But it's worth repeating, and emphasizing, that this is true of any DV cert, whether you paid for it or not, whether it was issued by Let's Encrypt or Comodo, etc. None of them validate the identity of the owner, because they simply aren't designed to. \*\* I don't believe it's for the CA to attempt to certify the _bona fides_ of its users; LE and Comodo appear to disagree on this, though LE's position doesn't go as far as I'd wish. But here's their position: > **[The CA's Role in Fighting Phishing and Malware - Let's Encrypt](https://letsencrypt.org/2015/10/29/phishing-and-malware.html)** > > Since we announced Let’s Encrypt we’ve often been asked how we’ll ensure that we don’t issue certificates for phishing and malware sites. The concern most commonly expressed is that having valid HTTPS certificates helps these sites look more... ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [February 14, 2018, 5:26pm UTC](https://community.letsencrypt.org/t/hosting-provider-claims-le-is-unsafe-en-google-will-stop-support-in-july-2018/52971/17 "2018-02-14T17:26:41Z")
> [@Frits](#): > > "It was a mistake to say Google is no longer supporting LE as of July, however, the difference between Let’s Encrypt and a paid-for certificate is that the paid-for certificates do a domain check: they check if the certificate is applied forby the holder of the domain. > > Let’s Encrypt does not do this. The check for domain name holder is an extra factor for reliability of the certificate. In other words: if someone as an individual registers a domain with an anonymous e-mail address (for example Hotmail or Gmail) en puts an SSL certificate on it then the traffic is encrypted but the https-address says nothing about the holder of the domain name. In theory this could be a criminal. I think the host is confusing DV, OV, and EV certificates here. There are other kinds of validations, that Let's Encrypt doesn't do, where an offline validation of the applicant's entity is performed. The CA will then contact the applicant in the physical world and/or verify identity documents submitted by the applicant. After doing this, the CA will put information about the applicant's offline identity into the certificate. In the DV certification style, which Let's Encrypt does, the verification is all online and is only aimed at checking that the applicant has control of the domain, without also checking who the applicant is in another way. DV has been criticized because someone who obtains apparent control of a domain illicitly can get a certificate, and someone who creates a site that's confusingly similar to an existing site can get a certificate (although this latter issue turns out to be true for EV as well, as long as the submitted identity documentation is correct on its own terms). DV also makes it easier for people to run sites anonymously, which can be viewed both positively and negatively by various people in various contexts. Let's Encrypt's certificates are available free of charge in large part because DV can be completely automated, so there's almost no marginal cost to Let's Encrypt in performing an additional automated verification. Let's Encrypt's fixed costs for infrastructure and staff can then be paid up-front by sponsorships and donations, and the total costs don't increase rapidly as the certificate volume grows. As several other people in this thread have mentioned, most paid CAs also do DV, performing the same kind of verification as Let's Encrypt does, by the same methods. Currently OV and EV certificates are only available from paid CAs, but that doesn't mean that all paid certificates are OV or EV. There's no difference in _cryptographic_ security between these types of certificate; users' connections are protected by the same encryption technologies. The difference is only in the identity information contained in the certificate and how it was checked. I am not persuaded that your host is deliberately misleading you, but nonetheless both of the explanations that you've been given have been inaccurate. ---
**Author:** ![BFeely](https://avatars.discourse-cdn.com/v4/letter/b/c37758/32.png) [@BFeely](https://community.letsencrypt.org/u/BFeely)\ **Post date:** [February 14, 2018, 10:53pm UTC](https://community.letsencrypt.org/t/hosting-provider-claims-le-is-unsafe-en-google-will-stop-support-in-july-2018/52971/18 "2018-02-14T22:53:13Z")
I would suggest shopping for a new hosting provider. You could try Linode which is a VPS provider, and they have a PoP in UK, which is somewhat close to NL. ---
**Author:** ![slokhorst](https://avatars.discourse-cdn.com/v4/letter/s/e47774/32.png) [@slokhorst](https://community.letsencrypt.org/u/slokhorst)\ **Post date:** [February 23, 2018, 5:14pm UTC](https://community.letsencrypt.org/t/hosting-provider-claims-le-is-unsafe-en-google-will-stop-support-in-july-2018/52971/19 "2018-02-23T17:14:44Z")
To expand on @schoen’s excellent answer: Of [the certificates your host offers](https://www.protagonist.nl/clouddiensten/ssl/): - “Rapid SSL” is exactly the same as what Let’s Encrypt offers. - “True business ID” also does offline business validation, but this isn’t something non-technical visitors see when visiting the site. - “True business EV” does a more strict offline validation and is shown in the visitor’s browser as a green bar with your legal name. My personal opinion: use Let’s Encrypt unless you want to want the green bar, which will cost you € 297 a year. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [March 25, 2018, 5:14pm UTC](https://community.letsencrypt.org/t/hosting-provider-claims-le-is-unsafe-en-google-will-stop-support-in-july-2018/52971/20 "2018-03-25T17:14:50Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.