Let's Encrypt alternative: when you actually need one

Usually you do not need one. What follows is the narrow set of situations where something else is warranted, stated as criteria rather than as reasons to worry.

Where it is stronger than the alternatives

Nearly everywhere, for the case it covers.

• Automation is the product

  Issuance and renewal happen through a protocol implemented by every serious client, described on ACME. Nothing about obtaining a certificate involves a person, which is what current certificate lifetimes require anyway.

• It is free, without a paid tier withholding anything

  There is no version of the same certificate you could buy that would be better, which distinguishes this from most free offerings, as discussed on free certificates.

• Ubiquity means everything supports it

  Clients, hosting platforms, control panels, and documentation all assume it. That is a practical advantage independent of any technical property: the path is well trodden and the failures are well documented.

• The trust position is settled

  It is present in trust stores everywhere, and has been long enough that the question does not arise.

Any comparison that opens by looking for weaknesses here is answering a question nobody asked.

What it does not do

Three things, and each maps to a situation rather than to a deficiency.

• Organisation or extended validation

  Only domain validation is offered, because that is what can be automated. Where a compliance framework, a customer's procurement process, or an internal policy names organisation validation, this is not the authority to use. See certificate types.

• A support relationship

  There is documentation and a community, and nobody contractually obliged to answer you. For most sites that is sufficient, and for some it is not.

• Long-lived certificates

  Lifetimes are short by design, which is correct for automated setups and a problem for devices that cannot be automated and must be updated by hand.

Absent from that list: nothing about encryption, browser acceptance, or the quality of the certificates. Those do not differ, as covered on choosing an authority.

When an alternative is warranted

Four situations. If none applies, the comparison is over.

• A requirement names organisation validation

  The requirement is the reason, and satisfying it means an authority that performs those checks. This is the most common legitimate case and it has nothing to do with technical merit.

• You need someone answerable

  Where a certificate problem must be escalated to a party under contract, that relationship is purchased. Worth being precise about what you are buying: a response obligation, not better certificates.

• A device cannot be automated

  Appliances and equipment that accept certificates only through a manual interface, and cannot handle frequent replacement, need a longer-lived certificate from an authority that issues them.

• Operational limits genuinely bind you

  At sufficient scale, or with many distinct names, limits become a planning constraint rather than a theoretical one. The shape of those limits and how to work within them is on rate limits, and the numbers belong there rather than here.

Reasons that are not reasons

Three arguments appear regularly and do not survive examination.

• "Free certificates are less trusted."

  Trust is binary and identical. There is no gradation among authorities in the trust stores, and no visitor sees a difference.

• "Short lifetimes are risky."

  They are the opposite: shorter validity limits the damage from a compromised key, which is why the industry moved this way. Short lifetimes are a problem only where automation is absent, which is a property of your setup rather than of the certificate.

• "You get what you pay for."

  In this specific market, what you pay for is validation depth and support obligations. The certificate itself is not a place where paying more produces a better artefact.

They matter because they are how the alternative is usually sold.

If you are considering switching to it

The blocker is rarely the authority and almost always automation. Moving from a manually installed annual certificate to short-lived automated ones means the renewal process changes, not just the supplier. Where automation is already running, switching is a configuration change; where it is not, the automation is the project and the authority is incidental.

The check to run first is whether your termination point can obtain certificates itself or work with a client, discussed on ACME clients. That answer determines whether this is an afternoon or a piece of infrastructure work.

What a support relationship actually buys

The thing purchased is an obligation to respond, and the value of that depends entirely on what you would escalate. Certificate problems fall into two groups, and only one of them benefits.

• Problems at the authority

  Issuance failing, validation behaving oddly, an urgent revocation needing processing. Here a contractual relationship helps: someone is obliged to look, and there is a route that does not depend on community goodwill.

• Problems at your end

  An incomplete chain, a configuration that was never reloaded, an expired certificate nobody renewed. These are the large majority of certificate incidents, and no authority's support helps with any of them, because nothing is wrong on their side.

So the question to ask before buying support is which group your likely incidents fall into. For a setup where certificates are automated and the failures are the ordinary operational ones, the support relationship addresses a category that rarely occurs.

Where it does earn its cost is in organisations that must be able to point at an accountable party during an incident, regardless of where the fault lies. That is an organisational requirement, not a technical one; it deserves to be named as such instead of being dressed as a reliability argument.

Alternatives worth knowing

Other authorities also offer automated domain-validated issuance, with differences in interface, tooling, and terms rather than in the certificates. ZeroSSL covers one such comparison.

Where organisation validation or a support relationship is the requirement, the field is commercial authorities generally, and the criteria on choosing an authority apply; no single comparison does.

Certificates handled for you with Bridge SSL

Bridge SSL obtains and renews certificates as part of serving your site, so which authority issues them stops being an operational concern. Where your requirement is organisation validation or a contractual support relationship, that is a different need and this page's criteria apply rather than any platform. See what Bridge offers at Bridge CDN.

FAQ