<div dir="ltr"><div>SSL certificates can be had for free via <a href="https://letsencrypt.org/">https://letsencrypt.org/</a></div><div><br></div><div>The easiest way to manage these certs is via <a href="https://certbot.eff.org/">https://certbot.eff.org/</a></div><div><br></div><div>They are only valid for a couple months each, but can be set up to automatically revalidate via http or DNS authentication.</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jul 27, 2021 at 12:10 PM Jay F. Shachter <<a href="mailto:jay@m5.chicago.il.us">jay@m5.chicago.il.us</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>
Esteemed Colleagues:<br>
<br>
I write today on behalf of a friend who has a website that offers free<br>
textbooks to download (<a href="http://potto.org" rel="noreferrer" target="_blank">http://potto.org</a>, for the curious). He is<br>
getting less traffic than he used to get, and he thinks it is because<br>
he does not support https. Apparently some browsers are now warning<br>
you when you connect to a website using http, and my friend thinks<br>
that this warning is scaring people way. There is, of course, no<br>
reason to care whether the free textbook you download is coming to you<br>
encrypted or unencrypted -- why would you care if the NSA is able to<br>
read a textbook on fluid dynamics? -- but my friend's theory is that<br>
some people, the moment they see a warning from their browser, run<br>
away from the site, regardless of whether it makes any sense or not.<br>
<br>
So now my friend wants to support https on his website. He thinks he<br>
will get more traffic that way. But if he installs a self-signed<br>
certificate on his website (like I have on mine, <a href="https://m5.chicago.il.us" rel="noreferrer" target="_blank">https://m5.chicago.il.us</a>),<br>
the same browsers that were warning people about unencrypted traffic,<br>
are now going to warn them about the self-signed certificate. Again,<br>
there is no reason to care whether <a href="http://potto.org" rel="noreferrer" target="_blank">potto.org</a> has a self-signed<br>
certificate. A self-signed certificate would only mean that you<br>
cannot know that the website claiming to be <a href="http://potto.org" rel="noreferrer" target="_blank">potto.org</a> really is<br>
<a href="http://potto.org" rel="noreferrer" target="_blank">potto.org</a>. But why would anyone care whether the free textbook on<br>
fluid dynamics that he is downloading, is coming to him from<br>
<a href="http://potto.org" rel="noreferrer" target="_blank">potto.org</a>, or from an imposter claiming to be <a href="http://potto.org" rel="noreferrer" target="_blank">potto.org</a>? If I have an<br>
account on CitiBank, and I am about to type in my account name and<br>
password to do some on-line banking, then I care whether I'm giving<br>
the information to <a href="http://citibank.com" rel="noreferrer" target="_blank">citibank.com</a> or to an imposter claiming to be<br>
<a href="http://citibank.com" rel="noreferrer" target="_blank">citibank.com</a>, but there is no logical reason to care whether <a href="http://potto.org" rel="noreferrer" target="_blank">potto.org</a><br>
is really <a href="http://potto.org" rel="noreferrer" target="_blank">potto.org</a> or an imposter. Nevertheless, my friend has a<br>
theory that whenever users get a warning from their browser, they run<br>
away, regardless of whether it makes sense.<br>
<br>
Which now brings me to my question, and the reason why I am posting<br>
this message to the ufo mailing list. What is the cheapest https<br>
certificate my friend can get? It doesn't have to be a certificate<br>
that will satisfy an expert. An expert wouldn't care whether he has a<br>
certificate at all. It just has to be a certificate that will keep<br>
the browsers from emitting a warning, which he thinks is scaring<br>
people away from his website. My friend operates as a non-profit<br>
organization, if that makes a difference. Thank you in advance for<br>
any and all replies.<br>
<br>
Jay F. Shachter<br>
6424 North Whipple Street<br>
Chicago IL 60645-4111<br>
(1-773)7613784 landline<br>
(1-410)9964737 GoogleVoice<br>
<a href="mailto:jay@m5.chicago.il.us" target="_blank">jay@m5.chicago.il.us</a><br>
<a href="http://m5.chicago.il.us" rel="noreferrer" target="_blank">http://m5.chicago.il.us</a><br>
<br>
"Quidquid latine dictum sit, altum videtur"<br>
_______________________________________________<br>
UFO Chicago -- Users of Free Operating Systems<br>
Free Software Rules -- Proprietary Drools!<br>
<a href="http://ufo.chicago.il.us/cgi-bin/mailman/listinfo/ufo" rel="noreferrer" target="_blank">http://ufo.chicago.il.us/cgi-bin/mailman/listinfo/ufo</a><br>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div>Thanks,<br><br></div>Dave<br></div></div>