12

What is the main difference (may be pro/con list) between buying a custom SSL certificate and getting one from Free certificate provided by Let's Encrypt. This is all about just having simple https in our Web Application

P.S I believe you understand what I am trying to do.

Cœur
  • 37,241
  • 25
  • 195
  • 267
madhairsilence
  • 3,787
  • 2
  • 35
  • 76

1 Answers1

12

The main practical difference is to be trusted in all browsers and third party systems, for example Android, iOS or Windows.

Lets encrypt has taken this restriction into account and has proposed a solution that you can read on its website https://letsencrypt.org/certificates/

Our intermediate is signed by ISRG Root X1. However, since we are a very new certificate authority, ISRG Root X1 is not yet trusted in most browsers. In order to be broadly trusted right away, our intermediate is also cross-signed by another certificate authority, IdenTrust, whose root is already trusted in all major browsers. Specifically, IdenTrust has cross-signed our intermediate using their DST Root CA X3.

That is, in fact, their certificates are signed by a trusted 'usual' CA. So in practice there is no difference

Take a look at letsencrypt's own web certificate, it is signed by DST Root CA X3 (IdenTrust) enter image description here

I have checked if CA is present in some keystore:

  • Chrome, IExplorer, Edge (using windows 10): OK
  • Mozilla Firefox: OK
  • Android (Nexus 5x -android 7): OK

Full list here: https://letsencrypt.org/docs/certificate-compatibility/

pedrofb
  • 37,271
  • 5
  • 94
  • 142