I was recently reminded that you should pay attention to a few things when paying online. That immediately raised a series of questions for me that I want to investigate — not just for myself, but to provide honest information to the people who come to Brainfusion. Below I will answer them one by one, without a sales pitch.
“You are safe with us, we use an SSL certificate” — and those colored locks?
There used to be three flavors of certificates,
- DV (Domain Validation) — just proves that the site owner controls the domain. Free variants such as Let’s Encrypt are included.
- OV (Organization Validation) — it has also been checked whether the company really exists.
- EV (Extended Validation) — the most expensive; used to show that green bar with the company name next to it.
The most important thing that almost no one knows: that colored bar no longer exists. Since 2019, Chrome and Firefox have removed the green EV label; Since 2023, Chrome no longer even shows a lock, but a neutral settings icon. In other words: today you can depend on the color of the lock nothing find out more about how “expensive” or “good” the certificate is. The lock only means: the connection is encrypted — not: this site can be trusted. A phishing site might as well have a valid lock.
Can someone “watch” when such a certificate is used?
No — not what you type or send. The certificate establishes an encrypted tunnel (TLS) between your browser and the server. Someone on the same Wi-Fi network, or your ISP, sees yes which site you connect to, but not the contents: no passwords, no amounts, no card details.
The certificate itself is public — that’s how it should be, it is the “public” half of the lock. No one can decipher anything with that; the secret key remains on the server. In practice, viewing is only possible at the ends: on the server itself (where it is decrypted), on an infected device, or on a business network that has deliberately installed its own “middleman”. An ordinary eavesdropper on the road won’t get through.
“All data goes with an API key — isn’t that open communication?”
This is a common misunderstanding. An API key is not encryption; it is just a kind of pass that allows the server to know who is knocking. The encryption comes from HTTPS/TLS, and the API key travels inside that encrypted tunnel. So it is not open on the street.
It would only be “open communication” if the data were simply shared http (without s) is sent — and a decent payment service never does that.
Is that 100% certain?
Honestly: 100% does not exist in security. But the encryption itself — the same technique that banks use — cannot be cracked in practice. The weak spot is never in mathematics, but in:
- expired or incorrectly set certificates,
- fake sites that still have a valid lock (the lock says nothing about honesty),
- an infected device or outdated TLS version.
In short: on the way your data is almost 100% safe. The attention must be focused with whom you talk and or your own device is clean.
Conclusion: open-source certificate or the expensive one with the colored locks?
The security of a certificate is entirely in the encryption — and that is identical, whether the certificate is free or very expensive. A free Let’s Encrypt certificate (open, automatic, which we use everywhere) encrypts just as strongly as the most expensive commercial certificate.
What you pay extra for the expensive variants is only the control over corporate identity — a layer of trust and marketing, no additional encryption. And its visible reward, that green bar, has disappeared from all browsers.
The short version: open-source/free is no less secure. With the expensive certificates you only pay for an identity check that most sites do not require.
And the future: certificates that have an increasingly shorter lifespan
There is something else going on that almost no one knows about, but that will affect everyone with a website in the coming years. The browsers and certificate issuers (united in the CA/Browser Forum) have agreed that certificates will always be valid for a shorter period become. It is not a law, but it is binding: every browser and every certificate issuer follows it, so in practice you cannot ignore it.
- Now (since March 2026): a certificate is valid for a maximum of 200 days.
- March 2027: that is halved to 100 days.
- March 2029: only 47 days left — about eight renewals per year, per domain.
The reason is security: the shorter a certificate lives, the less damage a stolen or misissued certificate can do. But it also means that manual renewal becomes untenable. If you forget to renew once, your site will suddenly be listed as “unsafe” or inaccessible. Automatic renewal and monitoring is therefore no longer a luxury, but a necessity.
We have fully automated this — for ourselves and as a service for others. Want to know more? View our page SSL Certificates.
How we do it at Brainfusion
“We Practice What We Preach: all our services run on free, open Let’s Encrypt certificates. And for payments we go one step further — we work with crypto payments via our own payment gateway, where we never see your card details and there are no private keys on our server (only receiving addresses). You pay directly, encrypted, without an intermediary.
Do you want to support me? View the payment options on our Donate page.