The Godaddy Certificate I Inherited Cost More Than The Site It Was Protecting

Doing a handover audit in june I found a line at 249 a year for a godaddy ssl certificate on a site whose hosting was 14 a month, and the client had been paying it since 2019 without once asking what it bought them. That is roughly 1,500 dollars for something let's encrypt does for nothing, which is the easy part of the story and not the interesting part. The interesting part is why it kept renewing. It was an ov cert, so somebody at godaddy had at some point done a business validation call, and the previous dev had written in a handover doc that the certificate was required by the payment provider. It was not. The payment provider requires tls, which any certificate gives you, and nobody had ever gone back to check the claim because the sentence sounded technical enough to be true. I see the same pattern with ev certs and the green bar that browsers stopped drawing in 2019, and people still buy them because somebody said the word compliance in a meeting once. The bit that made it awkward is that switching was not just clicking install. The certificate had been installed through the godaddy panel on a host the site had since migrated away from, so the auto renew was billing a card the client still had active while the site itself was serving a completely different certificate that the new host had provisioned. They were paying for a certificate that was not on the site at all. Twenty minutes with openssl to prove it and then a fairly uncomfortable emial to the finance person, who took it better than I deserved. What I do on every handover now is dump the served chain for every domain the client owns and put the issuer, the expiry and the price next to each other in one table, because the price column is where the conversation happens. Nobody argues about a renewal date and everybody argues about 249 dollars. I am not against paid certificates, there are real reasons to buy one, mostly a wildcard on infrastructure that cannot do a dns challenge or an insurer who has written a specific product into a policy. A brochure site for a dentist is not one of those reasons, and neither is a woo store, whatever the panel suggests at checkout.