0

I don't use SSL on my website currently. It's a small hobby site with no online store or anything of that nature that would need it. I've read that Google Chrome will stop loading such sites sometime in the near future. Are there going to be additional future consequences if I don't purchase a signed SSL certificate?

Improve this question
4
  • Besides other browser vendors making similar decisions? Commented Jul 4, 2019 at 9:12
  • 6
    You don't need to purchase one. You can get a free one from letsencrypt.org Commented Jul 4, 2019 at 9:15
  • Sigh. Here is my web host's opinion of Let's Encrypt: webhostingpad.com/ssl/#letsencrypt Quote: "blah blah blah... we do not allow Let's Encrypt SSLs on our servers—for your own protection." They of course offer their own, paid solution. Commented Jul 6, 2019 at 1:42
  • @posfan12 so find another host. Commented Jul 8, 2019 at 1:42

1 Answer 1

Reset to default
3

From what you are saying, I believe SSL is not necessary for your website, but it is always better to secure it with an SSL certificate if you don't want popular browsers to block its access!

I would recommend you to use letsencrypt to serve your website in https. letsencrypt provides you with a free ssl certificate that is valid for 90 days.

If you host the static files of your website on AWS, you can get your certificate from AWS certificate manager, this is also a solution.

Improve this answer
14
  • This is good news! I thought I was SOL. I will have to do some further research to get it installed and working. Commented Jul 4, 2019 at 13:07
  • Do the major browsers recognize this certificate as coming from a trusted CA? Otherwise, you'll still get "blocked" (Chrome will let you browse HTTP sites; it will just say that they're unsafe, and make you agree to be unsafe before it will let you browse them. Same with non-CA certificates). Commented Jul 4, 2019 at 15:28
  • 1
    @RobertHarvey see the link I gave for trust details, among other things "Our root is now trusted by all major root programs, including Microsoft, Google, Apple, Mozilla, Oracle, and Blackberry.". Commented Jul 4, 2019 at 16:38
  • 1
    Whoa. Only 90 days? Commented Jul 4, 2019 at 16:42
  • 1
    @Hans-MartinMosner the auto-renewal of letsencrypt does not happen out of the box when you ask for a certificate, you need to set up a bot that will take care of asking for a new certificate when needed... I use such bots on my EC2 instances to renew the certificate every 60 days. More info: certbot.eff.org/lets-encrypt/debianstretch-apache , moreover posfan12 is not asking how for a setup in particular... Commented Jul 5, 2019 at 9:40

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.