0

I don't use SSL on my website currently. It's a small hobby site with no online store or anything of that nature that would need it. I've read that Google Chrome will stop loading such sites sometime in the near future. Are there going to be additional future consequences if I don't purchase a signed SSL certificate?

4
  • Besides other browser vendors making similar decisions?
    – Caleth
    Commented Jul 4, 2019 at 9:12
  • 6
    You don't need to purchase one. You can get a free one from letsencrypt.org
    – Kayaman
    Commented Jul 4, 2019 at 9:15
  • Sigh. Here is my web host's opinion of Let's Encrypt: webhostingpad.com/ssl/#letsencrypt Quote: "blah blah blah... we do not allow Let's Encrypt SSLs on our servers—for your own protection." They of course offer their own, paid solution.
    – posfan12
    Commented Jul 6, 2019 at 1:42
  • @posfan12 so find another host.
    – Andy
    Commented Jul 8, 2019 at 1:42

1 Answer 1

3

From what you are saying, I believe SSL is not necessary for your website, but it is always better to secure it with an SSL certificate if you don't want popular browsers to block its access!

I would recommend you to use letsencrypt to serve your website in https. letsencrypt provides you with a free ssl certificate that is valid for 90 days.

If you host the static files of your website on AWS, you can get your certificate from AWS certificate manager, this is also a solution.

15
  • This is good news! I thought I was SOL. I will have to do some further research to get it installed and working.
    – posfan12
    Commented Jul 4, 2019 at 13:07
  • Do the major browsers recognize this certificate as coming from a trusted CA? Otherwise, you'll still get "blocked" (Chrome will let you browse HTTP sites; it will just say that they're unsafe, and make you agree to be unsafe before it will let you browse them. Same with non-CA certificates). Commented Jul 4, 2019 at 15:28
  • 1
    @RobertHarvey see the link I gave for trust details, among other things "Our root is now trusted by all major root programs, including Microsoft, Google, Apple, Mozilla, Oracle, and Blackberry.".
    – Kayaman
    Commented Jul 4, 2019 at 16:38
  • 1
    Whoa. Only 90 days? Commented Jul 4, 2019 at 16:42
  • 1
    @Hans-MartinMosner the auto-renewal of letsencrypt does not happen out of the box when you ask for a certificate, you need to set up a bot that will take care of asking for a new certificate when needed... I use such bots on my EC2 instances to renew the certificate every 60 days. More info: certbot.eff.org/lets-encrypt/debianstretch-apache , moreover posfan12 is not asking how for a setup in particular... Commented Jul 5, 2019 at 9:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.