0

I don't use SSL on my website currently. It's a small hobby site with no online store or anything of that nature that would need it. I've read that Google Chrome will stop loading such sites sometime in the near future. Are there going to be additional future consequences if I don't purchase a signed SSL certificate?

  • Besides other browser vendors making similar decisions? – Caleth Jul 4 at 9:12
  • 6
    You don't need to purchase one. You can get a free one from letsencrypt.org – Kayaman Jul 4 at 9:15
  • Sigh. Here is my web host's opinion of Let's Encrypt: webhostingpad.com/ssl/#letsencrypt Quote: "blah blah blah... we do not allow Let's Encrypt SSLs on our servers—for your own protection." They of course offer their own, paid solution. – posfan12 Jul 6 at 1:42
  • @posfan12 so find another host. – Andy Jul 8 at 1:42
3

From what you are saying, I believe SSL is not necessary for your website, but it is always better to secure it with an SSL certificate if you don't want popular browsers to block its access!

I would recommend you to use letsencrypt to serve your website in https. letsencrypt provides you with a free ssl certificate that is valid for 90 days.

If you host the static files of your website on AWS, you can get your certificate from AWS certificate manager, this is also a solution.

  • This is good news! I thought I was SOL. I will have to do some further research to get it installed and working. – posfan12 Jul 4 at 13:07
  • Do the major browsers recognize this certificate as coming from a trusted CA? Otherwise, you'll still get "blocked" (Chrome will let you browse HTTP sites; it will just say that they're unsafe, and make you agree to be unsafe before it will let you browse them. Same with non-CA certificates). – Robert Harvey Jul 4 at 15:28
  • 1
    @RobertHarvey see the link I gave for trust details, among other things "Our root is now trusted by all major root programs, including Microsoft, Google, Apple, Mozilla, Oracle, and Blackberry.". – Kayaman Jul 4 at 16:38
  • 1
    Whoa. Only 90 days? – Robert Harvey Jul 4 at 16:42
  • 1
    @Hans-MartinMosner the auto-renewal of letsencrypt does not happen out of the box when you ask for a certificate, you need to set up a bot that will take care of asking for a new certificate when needed... I use such bots on my EC2 instances to renew the certificate every 60 days. More info: certbot.eff.org/lets-encrypt/debianstretch-apache , moreover posfan12 is not asking how for a setup in particular... – C00kieMonsta Jul 5 at 9:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.