A related post worth reading is "Getting an A+ on Qualy's SSL Labs Tester" - https://sethvargo.com/getting-an-a-plus-on-qualys-ssl-labs-t...
Previous HN discussion: https://news.ycombinator.com/item?id=8749931
While, distro maintainers usually do a great job of maintaining software - I think it does highlight a certain need for another way to easily install bleeding edge without adding a whole other repo (which could contain/override versions of other software you may not want). You can always rpm/dpkg an individual package - but now your version will never been updated by the package manager, well by yum update/apt-get upgrade anyways (or even worse overwritten).
Do PPAs not fit your use case?
In any case - PPAs are a patch for the problem not a solution (and specific to Ubuntu). PPAs require third-party support and if a security issue is found and he (or they) are on vacation - your custom version of Apache is vulnerable. It's not a big issue for something like Wine, but I would just have a warm fuzzy feeling if the security team behind the distro supported it.
I'm even guilty of using random debs however I always check for red flags and go with my gut feeling. I have worked with a group of Linux people who refused to install packages I wanted from the Red-Hat community repos onto the servers (though they would freely install packages they wanted...)
https://cheapsslsecurity.com/comodo/positivessl.html
If that's a barrier, I don't know what to say. Registering the domain name probably costs twice that.
In many cases, the CA (or company you got your certificate from) will include this root cert in the chain. With most web servers it is perfectly fine to simply remove it, but I have seen applications where you cannot (VMware, which wants a complete chain ending with a self-signed cert) and where you'll have to ignore the SSL Labs warning.
This script looks very useful, thanks :)
