https://www.comodo.com/e-commerce/ssl-certificates/free-ssl-...
(Root in Windows, Cross-Signed by StartSSL for others)
Advantages 1. No Expiration for 3 Years 2. 256-bit strong encryption with 2048-bit SSL certificate 3. Domain validation by trusted Root certificate authority. 4. Lowest price SSL
Get Comodo PositiveSSL Certificate at only $4.99/year from CheapSSLSecurity and make your self free from SSL Expiration.
Visit here for mode details - https://cheapsslsecurity.com/comodo/positivessl.html.
But for me the biggest problem with adoption of SSL is still that every domain name needs it's unique IPv4 address, and all problems that come with that, not registering or paying for the SSL certificate.
At work, I usually use virtual hosting for about 100 domains on one IP address. I don't see us buying an IPv4 address per domain and adding them to my NIC configuration one by one. Once we can safely ignore IPv4 and use IPv6 only it will probably become easier and cheaper.
Only if you care about IE on Windows XP (which is no longer supported and no longer gets security updates) or Android phones more than 4 years old (2.3 Gingerbread and older). SNI works fine on other devices.
Have you measured? Do you have numbers for how many users you have running one of those two environments?
[1] http://www.movistar.com.ec/tienda/Marcas/Huawei/Huawei-Y210/...
All modern browsers support it, as do Nginx and Apache.
https://www.alphassl.com/ssl-certificates/free-ssl-certifica...
The Let’s Encrypt client is essentially an operating system component. Generically, it requires root privileges to bind to port 443 and (if requested) to reconfigure your webserver for certificate installation and renewal
That also seems like a perfect compromise vector for bad actors to modify the client software.
The Let's Encrypt effort is noble and definitely required but I think they would have been better-focused and quicker to market had they concentrated on establishing themselves as a CA first and leaving the 'auto-configuration magic' to a later stage, for the small subset of users who want that.
I want this project to proceed, but they should really focus on getting a much more mature and stable spec before launch. This isn't WebRTC, where you can just continuously tack on additional stuff or change the API constantly. It's TLS certs. The certs issued using this API end up telling people it's safe to input their passwords or credit card numbers.
I really hope the ACME spec gets stable before the launch in July.
[1]: https://github.com/letsencrypt/acme-spec/issues
[2]: https://github.com/letsencrypt/acme-spec/blob/master/draft-b...
I'm pretty sure they shouldn't tell users it's safe to type in credit card numbers -- these certs are "domain validation" (DV).
The certs that generate a green chip in the address bar are "extended validation" (EV) certs that typically cost hundreds and require a human to manually verify things.
[1]: http://security.stackexchange.com/a/15871
[2]: https://www.blackhat.com/presentations/bh-usa-09/SOTIROV/BHU...
There is an interesting HN discussion on the topic at https://news.ycombinator.com/item?id=8344238
For now, the certs are cross signed by "DST Root CA X3" operated by Identrust. This root has very strong inclusion.
For specifics, please see: https://groups.google.com/a/letsencrypt.org/forum/#!msg/clie...
What type of help is the Let's Encrypt team still needing?
Contributing to our software is one way to help:
https://github.com/letsencrypt/boulder
https://github.com/letsencrypt/lets-encrypt-preview
Also, if you work for a company that might be interested in sponsoring us, starting that conversation is another great way to help out.
Also, who pays for all this infrastructure? Mozilla?
Sponsorship is provided by multiple companies, including Mozilla. See https://letsencrypt.org/sponsors/ and https://letsencrypt.org/2015/04/09/isrg-lf-collaboration.htm... for more.
What's the hold up; HSMs that'll do secp256r1?
Because of the huge performance improvement ECDSA brings over RSA, I know I'm not going to be deploying Let's Encrypt certs until I can get ECDSA ones (as well as RSA ones, presumably).
