content: The difference it makes is that the user's activities on your site become a purely private transaction, which has massive value when all the user is doing is (for example) consuming content. If the user is not inputting sensitive information or installing downloaded software or such, we have a situation where:  The authenticity aspect adds almost no value Paying up for certification costs too much (free content, remember!) Self-signing will just cause the browser to slap the user with a scary message  As a result of that, the website operator just says fuck it, we were trying to do our users a favour by at least encrypting their activity to protect it from eavesdropping, but if it comes with all of this 'authenticity' baggage then we're not going to bother at all. The browser software in general is definitely to blame for this situation - it shows a scary message if a website DARES to provide encryption without authenticity, but it'll allow totally unsecured traffic to flow with no issue? The fault lies there, not with Let's Encrypt nor the websites which use it, and I believe it takes one hell of a hypocrite to call out LE on the basis of false sense of security while the browsers are behaving like that. Ideally:  With HTTP / no encryption, the browser should flag up the big warning With self-signed SSL, the browser should only show a prominent/regular warning if password fields or file downloads are involved With normal/LE SSL but no extended domain validation, the browser should show a minor warning not to buy or install anything  I agree absolutely that a basic Let's Encrypt certificate shouldn't be trusted when (for example) making a purchase which is high value, needs a physical address, or doesn't use a reputable third-party payment provider. The challenge is, as the article mentions, devising a practical way to educate the users about this.