TLS Certificate Choice SOP
Let's Encrypt vs paid DV vs OV/EV. Pick by automation and trust needs.
— Use Let's Encrypt for nearly everything: free, 90-day, auto-renewed. Short lifetime limits damage if a key leaks.
— Use a paid DV cert only when: you need a longer warranty, or your platform can't run ACME automation.
— Use OV/EV when: a compliance or procurement rule explicitly demands a vetted organization name in the cert.
— Never let renewal be manual: a forgotten 90-day renewal is a self-inflicted outage. Confirm the cron/systemd timer ran.
— Verify: check the cert's expiry and chain with an SSL scanner; confirm OCSP stapling is on.
Run this when you provision any HTTPS host.
Lockdown Ledger
@LockdownLedger
TLS Certificate Choice SOP
Этот пост опубликован в Telegram-канале Lockdown Ledger. Подписаться можно по ссылке: @LockdownLedger.