SSL certificates - Let's encrypt

Giggidy · 12 January 2018 at 11:00PM

I have a website that's in the final stages of being built by a developer using Wordpress with WooCommerce. It is an e-commerce site for my subscription box business, so will have recurring monthly payments and therefore I need to secure it. I use Vidahost cloud hosting and they charge £46.80 for a SSL certificate, or installing a third party one for £22.80. Alternatively, you can install a Lets Encrypt SSL certificate free of charge. Is Lets Encrypt as secure as the other paid for options?

onomatopoeia99 · 13 January 2018 at 12:19AM

In terms of encrypting communications it is, they all use the same algorithms. You don't get things like extended validation (you won't get that on cheap certificates from the well known brands either) or wildcards though. I've been using one to secure my IMAP server for the last couple of years without problems.

Be aware that their certificates last three months, not some multiple of years. They have a tool (certbot) that auto-renews them, if you can install extra software on your site.

Giggidy · 14 January 2018 at 12:55AM

Would I need to physically renew it every 3 months, if I am not able to install the certbot?

onomatopoeia99 · 14 January 2018 at 1:28AM

Yes, because the certificates only have three month duration, so you'd need to request a new one and install it. Do you value the time it would take you at more than £6/quarter?

buglawton · 14 January 2018 at 10:24AM

By coincidence
https://www.theregister.co.uk/2018/01/13/lets_encrypt_certificate_drama/

onomatopoeia99 · 14 January 2018 at 3:22PM

I've never liked SNI. TLS works at a level above HTTP so name based virtual hosting should never be possible for secure sites.

Giggidy · 14 January 2018 at 4:41PM

Thanks for the info, but I have no idea what that means, can you explain it to me in laymen's terms please?

martinbsp · 15 January 2018 at 12:32PM

That response in itself should indicate that you'd be better of spending a bit more and getting the certificate installed by someone on your behalf.

ehlo · 15 January 2018 at 12:59PM

Giggidy wrote: »

Would I need to physically renew it every 3 months, if I am not able to install the certbot?

onomatopoeia99 wrote: »

Yes, because the certificates only have three month duration, so you'd need to request a new one and install it. Do you value the time it would take you at more than £6/quarter?

Giggidy, looking at Vidahosts website, it seems as though they handle the auto-renewal for you. This it what any competent company should do for Lets Encrypt

.

The developer you're working with should be able to provide further details if you need them.

Giggidy · 15 January 2018 at 11:13PM

ehlo wrote: »

Giggidy, looking at Vidahosts website, it seems as though they handle the auto-renewal for you. This it what any competent company should do for Lets Encrypt .

The developer you're working with should be able to provide further details if you need them.

So far Vidahost's service has been fantastic! They helped me set Let's encrypt up on my website, the developer just has to force the https redirect I was told

tronator · 16 January 2018 at 4:33PM

onomatopoeia99 wrote: »

Be aware that their certificates last three months, not some multiple of years. They have a tool (certbot) that auto-renews them, if you can install extra software on your site.

If a company offers Let's Encrypt then they will most certainly have the certbot installed and let it renew the certificates automatically. Otherwise what would be the point of offering LE?

SSL certificates - Let's encrypt

Comments

Categories

Get our FREE Weekly email full of deals & guides - and it’s spam-free