Comment on Letsencrypt is under US jurisdiction. Is there a free-er alternative?

• bjoern_tantau@swg-empire.de ⁨3⁩ ⁨hours⁩ ago

  Usually they make money with extended certificates where they not only offer a certificate for example.com but also certify that it belongs to Example Ltd.

  Those extended certificates used to show the company name next to address bars, but I don’t think browsers do that anymore.

  original

  • victorz@lemmy.world ⁨3⁩ ⁨hours⁩ ago

    a certificate for example.com

    also certify that it belongs to Example Ltd.

    I thought that was the whole point of a certificate, to show that the website belongs to the company? Or nah?

    original

    • bjoern_tantau@swg-empire.de ⁨2⁩ ⁨hours⁩ ago

      Nah, the point is to encrypt the traffic and tell you what you are receiving really comes from example.com and not an evil third party.

      original

      • victorz@lemmy.world ⁨2⁩ ⁨hours⁩ ago

        Ah, right. That’s the primary purpose, thank you for the reminder! 🙏

        original
    • WhyJiffie@sh.itjust.works ⁨2⁩ ⁨hours⁩ ago

      It’s actually to prove that a web server belongs to (or is trusted by for delivering their content) a specific website.

      qualified certificates go a step further, by proving that a web server belongs to a specific company or a real person. but that’s costly, because verification is inherently more difficult.

      original