# SSL installation
**URL:** https://meta.discourse.org/t/ssl-installation/132621
**Category:** Self-hosting
**Created:** [November 5, 2019, 6:56am UTC](https://meta.discourse.org/t/ssl-installation/132621 "2019-11-05T06:56:19Z")
**Posts on this page:** 19
**Page:** 1
### Author:  [@calavera](https://meta.discourse.org/u/calavera)
#### Post date: [November 5, 2019, 6:56am UTC](https://meta.discourse.org/t/ssl-installation/132621/1 "2019-11-05T06:56:19Z")
Hi!
I installed discourse ready vps on digitalocean. My website works on https. Free lets ssl i guess. Is it really safe? I also bought comodossl. When i want to create certificate on comodo panel. It asks me my CSR code. How can I create CSR? Or do i do something wrong? First time I am doing. Please direct me.
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [November 5, 2019, 7:28am UTC](https://meta.discourse.org/t/ssl-installation/132621/2 "2019-11-05T07:28:46Z")
The SSL generated by discourse is issued by letsencrypt and it is pretty safe.
However if You want to set up your own ssl.certificate, follow these instructions:
> [@Allow SSL / HTTPS for your Discourse Docker setup](https://meta.discourse.org/t/advanced-setup-only-allowing-ssl-https-for-your-discourse-docker-setup/13847):
>
> This guide is likely out of date as there are now very few reasons not to use the built-in Let’s Encrypt certificate that Just Works. See also: 2023-04-10 @pfaffman says: This is left here mostly for historical purposes. So you’d like to enable SSL for your Docker-based Discourse setup? Let’s do it! This guide assumes you used all the [standard install](https://meta.discourse.org/t/142537?silent=true) defaults – a container configuration file at/var/discourse/containers/app.yml and Discourse docker is installed at: /var/discourse Buy a SS…
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [November 5, 2019, 7:56am UTC](https://meta.discourse.org/t/ssl-installation/132621/3 "2019-11-05T07:56:29Z")
There’s no difference from a security perspective between Let’s Encrypt and Comodo. The encryption supported is the same. The only difference is that one is free and automatic, the other costs money and must be renewed manually. Unless you have a really, _really_ good reason to need a paid cert, stick with Let’s Encrypt and save yourself the headache (and some money).
---
### Author:  [@calavera](https://meta.discourse.org/u/calavera)
#### Post date: [November 5, 2019, 8:42am UTC](https://meta.discourse.org/t/ssl-installation/132621/4 "2019-11-05T08:42:30Z")
Let’s Encrypt for forever? Or need to something else annual like renewing?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [November 5, 2019, 9:40am UTC](https://meta.discourse.org/t/ssl-installation/132621/5 "2019-11-05T09:40:05Z")
It renews automatically every three months. It’s free. And works.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [November 5, 2019, 10:37am UTC](https://meta.discourse.org/t/ssl-installation/132621/6 "2019-11-05T10:37:03Z")
There’s no reason to buy certificates for your discourse installation.
---
### Author:  [@danb35](https://meta.discourse.org/u/danb35)
#### Post date: [November 5, 2019, 6:08pm UTC](https://meta.discourse.org/t/ssl-installation/132621/7 "2019-11-05T18:08:09Z")
A certificate is a certificate\*, and Comodo has been pretty well established as a bad actor in this field due to their nonstop FUD against Let’s Encrypt (to the extent of [using their own web browser to mark sites using Let’s Encrypt certs as “not secure”](https://community.letsencrypt.org/t/comodo-dragon-browser-possibly-missing-ca-roots-to-trust-lets-encrypt/45143), or [attempting to trademark Let’s Encrypt themselves](https://tech.slashdot.org/story/16/06/23/1946249/comodo-attempting-to-register-lets-encrypt-trademarks-and-thats-not-right)). The certificate doesn’t dictate the kind or strength of the encryption used. Bottom line, use the cert from Let’s Encrypt; there’s simply no need for anything else.
\*Well, mostly. Certs can be DV (domain validation), OV (organization validation), or EV (extended validation), differing in what they validate (and, naturally, the cost). A DV cert validates that it does in fact belong to the domain it names. An OV cert validates that it belongs to the organization it names (though nothing shows you this in a browser unless you drill down to the certificate details). An EV cert does the same thing as an OV cert, only more so–and historically has given the “green bar” in the browser, though that’s going away shortly. No variety of cert validates that its owner is a “good guy,” and there’s absolutely no difference in encryption levels among them.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [November 5, 2019, 7:16pm UTC](https://meta.discourse.org/t/ssl-installation/132621/8 "2019-11-05T19:16:00Z")
> [@danb35](#):
>
> A DV cert validates that it does in fact belong to the domain it names
Let’s Encrypt effectively achieves this, by validating the DNS name at enrollment.
> [@danb35](#):
>
> An EV cert does the same thing as an OV cert, only more so–and historically has given the “green bar” in the browser, though that’s going away shortly.
Chrome 77 removed the green bar, for reference we’re currently on 78.x in release and 79.x in beta.
> **[Extended Validation Certificates are (Really, Really) Dead](https://www.troyhunt.com/extended-validation-certificates-are-really-really-dead/)**
>
> Almost one year ago now, I declared extended validation certificates dead
> \[https://www.troyhunt.com/extended-validation-certificates-are-dead/\]. The entity name had
> just been removed from Safari on iOS, it was about to be removed from Safari...
---
### Author:  [@danb35](https://meta.discourse.org/u/danb35)
#### Post date: [November 5, 2019, 7:18pm UTC](https://meta.discourse.org/t/ssl-installation/132621/9 "2019-11-05T19:18:38Z")
> [@Stephen](#):
>
> Chrome 77 removed the green bar, for reference we’re currently on 79.x
Hence my saying “historically.” It’s gone away in Chrome, but it’s still there in Firefox and IE (the only others I can readily test at the moment).
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [November 5, 2019, 7:30pm UTC](https://meta.discourse.org/t/ssl-installation/132621/10 "2019-11-05T19:30:17Z")
It’s gone from the address bar in Firefox 70 too, [which landed last month](https://www.mozilla.org/en-US/firefox/70.0/releasenotes/). It’s also gone from Safari.
I’m not sure IE counts as a browser any more, with a market share of 1.98% as of October of 2019.
I think we can confirm EV as stone dead at this point.
---
### Author:  [@Justin\_Vega](https://meta.discourse.org/u/Justin_Vega)
#### Post date: [November 5, 2019, 7:31pm UTC](https://meta.discourse.org/t/ssl-installation/132621/11 "2019-11-05T19:31:47Z")
> [@Stephen](#):
>
> I’m not sure IE counts as a browser any more, with a market share of 1.98% as of October of 2019.
What about Microsoft Edge?
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [November 5, 2019, 7:34pm UTC](https://meta.discourse.org/t/ssl-installation/132621/12 "2019-11-05T19:34:21Z")
2.05%, so less than the preinstalled browser Samsung ships on their Galaxy phones (3.29%).
---
### Author:  [@Justin\_Vega](https://meta.discourse.org/u/Justin_Vega)
#### Post date: [November 5, 2019, 7:34pm UTC](https://meta.discourse.org/t/ssl-installation/132621/13 "2019-11-05T19:34:51Z")
Its market share is on par with Internet Explorer? Would that make it not really count as a browser any more too?
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [November 5, 2019, 7:37pm UTC](https://meta.discourse.org/t/ssl-installation/132621/14 "2019-11-05T19:37:14Z")
Hence Microsoft moving Edge over to Chromium on January 15th 2020.
---
### Author:  [@Justin\_Vega](https://meta.discourse.org/u/Justin_Vega)
#### Post date: [November 5, 2019, 7:49pm UTC](https://meta.discourse.org/t/ssl-installation/132621/17 "2019-11-05T19:49:25Z")
Ah, yes. We’ll have to see how that goes.
---
### Author:  [@danb35](https://meta.discourse.org/u/danb35)
#### Post date: [November 6, 2019, 3:09am UTC](https://meta.discourse.org/t/ssl-installation/132621/18 "2019-11-06T03:09:50Z")
> [@Stephen](#):
>
> I think we can confirm EV as stone dead at this point.
Agreed. It will be interesting (and alternately amusing and frustrating, no doubt) to see what other selling points the CAs come up with to try to sell them, though.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [November 6, 2019, 3:13am UTC](https://meta.discourse.org/t/ssl-installation/132621/19 "2019-11-06T03:13:21Z")
EV arrived at a time where PKI wasn’t well understood, SSL was seen as “e-commerce only” and phishing was seeing a sharp uptick.
I appreciated the idea of adding trust, it was really the CAs who screwed it up.
Let’s encrypt is a huge threat to these guys, for all the right reasons.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [July 26, 2023, 2:39pm UTC](https://meta.discourse.org/t/ssl-installation/132621/20 "2023-07-26T14:39:35Z")
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [July 26, 2023, 2:40pm UTC](https://meta.discourse.org/t/ssl-installation/132621/21 "2023-07-26T14:40:52Z")