Thanks for that detailed and interesting reply, Jonathan.

On Sun, Jun 18, 2017 at 12:35 PM, Jonathan Rochkind <[log in to unmask]>
wrote:

> Just to clarify, by "Commercial certificates offer stronger proof of
> identity", you mean an "Extended Validation" (EV) certificate.
> https://en.wikipedia.org/wiki/Extended_Validation_Certificate
>
> If you are getting a 'commercial certificate' that is a standard 'domain
> validated' cert instead of an EV cert, you are not getting any stronger
> proof of identity than you would from letsencrypt.
>
> The cert used at https://www.ubalt.edu does NOT appear to be an EV cert,
> but an ordinary domain validated one. (Additionally, that particular web
> page serves http: images , triggering browser mixed content warnings!).
>
> Same thing for the cert at https://langsdale.ubalt.edu/.
>
> Looking at another Maryland public university:  https://umd.edu/ appears
> similar. NOT an EV cert, and additionally serving http assets triggering a
> mixed content warning.
>
> I'm actually having trouble finding an academic institution, or even a
> standard ecommerce site, that DOES use an EV cert.
>
> You can tell it's an EV cert when chrome or Firefox put the name of the
> organization in the location bar to the left of URL.  Additionally, in
> Firefox, if you click that name, then click the right-chevron 'more info'
> icon, then click "More information", under "Website Identity" it will list
> an "Owner:" for an EV cert. For an ordinary domain-validated cert, it will
> list "This website does not supply ownership information" instead.
>
> Here's an example of an EV cert, the cert on digicert.com, a seller of
> certs:
>
> https://www.digicert.com/
>
> If your cert is not EV but is just "domain validated", then despite it
> being "commercial" it supplies the same level of proof of identity as a
> letsencrypt cert -- proof of control of the domain at the time the cert was
> issued, either way.
>
>
>
> On Sat, Jun 17, 2017 at 1:53 PM, Cary Gordon <[log in to unmask]> wrote:
>
> > We are starting to roll out LetsEncrypt for all of our services and
> > clients who do not use or want commercial certificates.
> >
> > Note that LetsEncrypt offers only domain authentication, in most cases
> > specifically validated by your control of the server. Commercial
> > certificates offer stronger proof of identity.
> >
> > We recommend commercial certificates for any sites that conduct financial
> > transactions or require HIPPA compliance.
> >
> > Thanks,
> >
> > Cary
> >
> > Cary Gordon
> > The Cherry Hill Company
> > http://chillco.com
> >
> >
> > > On Jun 16, 2017, at 12:34 PM, Kyle Breneman (via lita-l Mailing List) <
> > [log in to unmask]> wrote:
> > >
> > > Apologies for cross-posting...
> > >
> > > Anyone out there working at a public institution that's using Let's
> > Encrypt for security certificates?  I just suggested to our campus IT
> that
> > we switch to using Let's Encrypt.  They told me it would need to clear
> > State of Maryland approval process first, and suggested that it would be
> > helpful to be able to point to other public institutions that are using
> it.
> > >
> > > Regards,
> > > Kyle Breneman
> > > Integrated Digital Services Librarian
> > > University of Baltimore
> > >
> > > To maximize your use of LITA-L or to unsubscribe, see
> > http://www.ala.org/lita/involve/email
> >
>