Original question: https://twitter.com/matbacon89/status/667348413470650370
Person's response: https://twitter.com/matbacon89/status/667348648741744640
In between, they _did_ say something like "You'll have to wait and see! :)"
I wonder if they deleted it in light of this blog post, which I find disingenuous: https://blog.namecheap.com/ssl-from-namecheap-whats-the-diff...
Does the blog post I linked to reflect the opinion of most of Namecheap, though, really? I like Namecheap and I would be disappointed if the majority of the company believed that all free CAs will be operated like Let's Encrypt.
Perhaps, though, you could pass it along to whomever it concerns, that the blog post reflects poorly on Namecheap. It's obviously targeting Let's Encrypt, but it uses vague phrases like "SSL certs from free providers" that _do_ come across as blanket statements.
On the other key differences:
- Shorter lifetimes is actually an advantage, since it reduces the risk when your keys are compromised. Revocation is a mess, the only way you can be sure that a certificate can no longer be used is when it's expired.
- No wildcards is an advantage too, since you can give each service its own certificate and if one is compromised, the others are fine. If you're using an organization-wide wildcard cert, a compromise is much worse.
- Limited flexibility - "you must have root access to your servers " is factually incorrect, the automated Let's Encrypt client is optional and you can request a certificate manually.
- Limited support - why would I need a SLA for a certificate, anyway? The OCSP servers?
- Management difficulties - while this is true now, the automation enabled by Let's Encrypt is likely to facilitate management, not the contrary. I'm currently working on a Puppet module which will automatically provision certificates for web servers, something which used to be much harder.
- Build Trust with Purchased SSL - how do I increase trust by using a OV certificate? It's not like an average website user would look up the certificate details, and there's no functional difference between a OV and a DV certificate.
> The levels of encryption, validation, and trust that business and commerce websites require are available only with purchased SSL.
Unless you're talking about EV certificates, I don't see how. There's no "level of encryption" which isn't available with a free CA, and the additional validation and trust do not matter unless it's a EV certificate. Even an EV certificate does not protect against MitM. The real answer is key pinning.
As a Namecheap customer, I'm disappointed by this blog post. It reads like an attempt to spread FUD about free DV certificates. I initially became a customer because I read good things about your business ethics, but this makes me question my choice.
> We think that validation of a certificate’s owner is an important point that needs to be highlighted and discussed. Recent developments in SSL automation are fantastic from a technical point of view, however, consumers need to be educated on this new security paradigm and the appropriate signals to look for when making a security determination. Looking for ‘https’ and a lock in the browser bar, the traditional indicators that have been messaged as reliable, may not be so reliable anymore when it comes to the consumer definition of security.
This is laughable. It's been hard enough to get users to check for the presence of a security indicator at all. Most don't even know the difference between DV and EV, and EV certificates do have a strong visual indicator. OV certificates don't have any, except
Hell, I might not realize in time that my online banking session only has a DV certificate today instead of EV and I'm a professional.
Sure, I sometimes check which CA a particular site is using, out of curiosity. But no normal user is ever going to do that on a regular basis.
> Additionally, any time we receive a report of abusive activity and/or fraud involving a certificate, Namecheap works with CA’s to investigate the reported sites, and CA’s often take quick action to revoke site certificates as a result. This third-party revocation capability is important; it provides an additional layer of post-issuance protection.
Soo... How does that protect me as a Namecheap customer? Buying from Namecheap doesn't mean that an attacker couldn't request a Let's Encrypt certificate anyway, unless you use cert pinning and you can do that with free certificates. There are some enterprise use cases where you'd just pin the CA instead of single certs, but those only matter at scale.
Namecheap is right about OV certificates being more trustworthy than DV ones, but the thing is - it doesn't really matter.
> Additionally, given recent developments, we strongly believe that additional education is required on the correct signals for consumers to use when making a security determination; browsers must necessarily shoulder some of this responsibility,
Like.... EV certificates? C'mon, browser vendors aren't going to add another security indicator just to protect your revenue.
I guess I didn't expect them to put their profits over what's best for the web.