English
Magyar
Let’s Encrypt is a non-profit Certificate Authority (CA) founded and supported by major internet organisations such as the Electronic Frontier Foundation (FFF), Mozilla and the Internet Security Research Group (ISRG). The aim of the initiative is to provide free SSL certificates to everyone, thereby making the internet a safer place.
Whilst Let’s Encrypt is certainly doing commendable work, it is no secret that, for commercial purposes, there is still a need for Certificate Authorities with a long-standing track record. These include Symantec, Comodo, GeoTrust, RapidSSL and Thawte. Another point in their favour is the fact that their certificates, which provide basic encryption and domain validation, are now available at extremely low prices, and their names are a guarantee of trust for the majority of internet users.
One argument against Let’s Encrypt is that it is unable to provide more important types of SSL certificates, such as Extended Validation (EV) certificates or multi-domain certificates.
Let’s Encrypt is subject to significant restrictions
As Let’s Encrypt has limited resources and infrastructure, it has had to introduce some very significant restrictions. Because it is free, it only provides automated, basic encryption and Domain Validated SSL certificates, thereby omitting many of the benefits that would otherwise come with SSL certificates.
The certificate offered by Let’s Encrypt merely verifies the domain owner, but does not contain any details about the business, meaning that the validation specialist must spend extra time obtaining the latter. Nor does it offer any of the certificate features included in both the basic and paid versions, including the well-known trust seal, which can be prominently displayed on certified websites.
Businesses are increasingly keen to demonstrate to their visitors that they handle data reliably; an excellent example of this is the use of SSL indicators that can be enabled in web browsers. Examples of such indicators include the padlock icon, which indicates a secure connection, or the name displayed in green in the address bar, which only appears on certified websites.
Companies can still obtain these elements from paid service providers such as Symantec or Comodo, which offer the appropriate OV or EV certificates for this purpose.
An OV certificate indicates corporate verification, whereby the company’s details are authenticated following a check of its corporate documents. An EV certificate represents the highest level of verification, which also involves verifying the identity of the contact person working for the certified company. When this is in place, a green bar appears in the browser.
All the largest companies use EV certificates, as this is the easiest way to demonstrate reliability and security to visitors. Twitter, Apple and PayPal all use this method to indicate to their customers that they have arrived at the official website and can now safely enter their personal details. Even the largest banks use this certificate exclusively; moreover, it is less vulnerable to attack, and hackers are unable to reproduce the green browser bar on spoofed websites.
It is already clear that the significant shortcomings of Let’s Encrypt mentioned above will deter many customers from using it.
People need more than just free SSL
Anyone who has ever sold SSL certificates knows that simply selling an SSL service to customers isn’t enough. SSL isn’t the sort of product where the transaction ends with the purchase!
You need help even just to choose the right SSL service. After that, you need to add the purchased service to your website, and then you need help with authentication, placing the trust seal, resolving various issues and keeping track of updates. What’s more, these issues are just the basics and can arise even with a basic domain-validated certificate; by comparison, OV and EV validations require much more assistance.
As it is a free service, Let’s Encrypt does not have the capacity to assist customers with installing their first SSL certificate, nor can it provide a support team available round the clock, every day of the year, to resolve issues. Community support is available, where a large number of dedicated individuals answer questions in their spare time, but this is not a solution that any company can rely on if it does not want to fall behind in today’s fast-paced world. No company can risk the continuity of its business operations or the loss of customer trust just to save a few thousand forints – it simply isn’t worth it!
People clearly don’t need a free certificate, but rather a reliable one, backed up by a round-the-clock support team and support. Businesses are more willing to pay for a service if it offers an effective solution should a problem arise.
Studies have also shown that customers trust established Certificate Authorities such as Symantec, Comodo, GeoTrust and Thawte; moreover, a clearly visible trust seal increases customer confidence and, consequently, conversion rates. This is particularly true of the Norton Secure Seal, which is included with every certificate offered by Symantec and is one of the best-known brands on the internet.
The model offered by Let’s Encrypt – the one-size-fits-all solution to every problem – is not perfect. A personal blog obviously needs a different type of certificate to a large corporate portal. It is expected that more and more websites will recognise the importance of authentication, so the future belongs to providers offering a variety of certificates.