In a previous life, I routinely blocked anything from a free cloud host or cert provider. There was rarely a business justification for accessing a site or service hosted on DigitalOcean or signed by LetsEncrypt. Sure, get an SSL cert and host for your personal project - so I wasn’t mad at the services - but it was a signal that the endpoint was not trustworthy beyond the TCP packets.
I suspect that AWS/GCP/Azure has made that much harder.
Yeah now let’s encrypt and other free cert providers are ubiquitous so it doesn’t make sense to block them. But you do need EV ssl for certain industries and markets like banking.
You have to get a certificate from a provider which can verify you control the domain.
Once you’ve proved control you install the signed certificate with the secret private key on your server.
You can get certificates for free via Let’s Encrypt and a bunch more CA’s. It hasn’t been expensive for ages, unless you want fancy corporate support.
Corporate support can be a big deal.
In a previous life, I routinely blocked anything from a free cloud host or cert provider. There was rarely a business justification for accessing a site or service hosted on DigitalOcean or signed by LetsEncrypt. Sure, get an SSL cert and host for your personal project - so I wasn’t mad at the services - but it was a signal that the endpoint was not trustworthy beyond the TCP packets.
I suspect that AWS/GCP/Azure has made that much harder.
Yeah now let’s encrypt and other free cert providers are ubiquitous so it doesn’t make sense to block them. But you do need EV ssl for certain industries and markets like banking.