Hacker News Reader

Comment by bigbuppo | Hacker News Reader

The good news is that the CAs signed their own death warrant with this change. If switching to ACME is more or less mandatory, what purpose do paid certificates serve? Your options are to use LE, switch to non-CA-issued encryption, or drop encryption entirely.

View on HN

You assume it’s just the certs being purchased - and not support, SLAs, other related products, management platforms, private PKI and more. If all you do is public TLS, sure, that might be an issue.

New web features are https-only by default, since a few years ago. So if your site uses any recent APIs, dropping encryption is not an option.

Secure context is only required for features that are somehow privacy- or security-sensitive. Some notable features are on the list, but you can absolutely have a modern site that doesn't rely on any of these.

Securing your communications is required to mitigate against main in the middle attacks.

Paid certs are valid for 1-year from the $$ CAs. LE certs are only good for ~3-4 months before they have to be reissued. If there's no easy way to do an automated ACME setup to handle the renewal, being able to defer that for a year is worth the $20 or $70 for a wildcard.

If paid certs drop in max validity period, then yeah, zero reason to burn money for no reason.

The $$ CAs will soon only issue 45-day certs, because that's all that browsers will accept.

Reply on news.ycombinator.com