[{"data":1,"prerenderedAt":706},["ShallowReactive",2],{"blog-lets-encrypt-vs-google-trust-services":3,"blog-nav":702},{"id":4,"title":5,"body":6,"cover":688,"dateModified":688,"datePublished":689,"description":670,"draft":690,"extension":691,"meta":692,"navigation":693,"path":694,"seo":695,"sitemap":696,"stem":697,"summary":698,"tags":699,"__hash__":701},"blog\u002Fblog\u002Flets-encrypt-vs-google-trust-services.md","Let's Encrypt vs Google Trust Services：两大免费SSL证书如何选择",{"type":7,"value":8,"toc":669},"minimark",[9,13,17,25,31,35,38,54,57,111,115,118,238,242,306,309,322,338,342,444,453,462,466,473,477,550,569,572,576,579,583,596,600,608,611,637,644,647],[10,11,12],"h2",{"id":12},"前言",[14,15,16],"p",{},"免费 SSL 证书里，Let's Encrypt 与 Google Trust Services（下文简称 GTS）是最常被放在一起比较的两个名字：前者是 ACME 协议的开创者、自动化证书的事实标准；后者背靠 Google 品牌，google.com 自身就使用它的证书。",[14,18,19,20,24],{},"申请证书时很多人纠结：",[21,22,23],"strong",{},"谁的兼容性更好？谁的生态更好用？"," 网上流传着不少过时结论（如「Let's Encrypt 兼容 Windows XP」「Google 证书兼容性差」），本文回到根证书信任库与官方链公告等一手信息，给出一份截至 2026 年的准确对比。",[26,27,28],"blockquote",{},[14,29,30],{},"先给结论：现代环境下两者完全等价；Android 7 及以下等超老旧设备 GTS 的备选链更稳；需要 IP 地址证书或最成熟的工具链则选 Let's Encrypt。分场景选型建议见第五节。两家 CA 在本站均支持免费申请。",[10,32,34],{"id":33},"一兼容性不是品牌问题看根与链","一、兼容性不是品牌问题：看根与链",[14,36,37],{},"证书「兼容性」的本质只有两件事：",[39,40,41,48],"ol",{},[42,43,44,47],"li",{},[21,45,46],{},"根证书是否在设备的信任库中","：操作系统、浏览器、Java 运行时都内置一份根证书清单，链必须锚到清单内的根才被信任；",[42,49,50,53],{},[21,51,52],{},"服务端握手时下发哪条链","：同一张叶子证书可以组装出不同的中间\u002F根路径，老旧客户端能否通过验证，取决于服务端是否下发「兼容链」。",[14,55,56],{},"抓住这两点，再看两家 CA 的底牌：",[58,59,60,79],"table",{},[61,62,63],"thead",{},[64,65,66,70,73,76],"tr",{},[67,68,69],"th",{},"证书颁发机构",[67,71,72],{},"根证书",[67,74,75],{},"进入主流信任库的时间窗",[67,77,78],{},"链结构特点",[80,81,82,97],"tbody",{},[64,83,84,88,91,94],{},[85,86,87],"td",{},"Let's Encrypt",[85,89,90],{},"ISRG Root X1",[85,92,93],{},"2015–2017 年集中进入（Java 自 2016 年 8u101 起）",[85,95,96],{},"单根直链，结构简单",[64,98,99,102,105,108],{},[85,100,101],{},"Google Trust Services",[85,103,104],{},"GTS Root R1 \u002F R2 \u002F R3 \u002F R4",[85,106,107],{},"2018–2022 年陆续进入（Java 迟至 2022 年 8u321）",[85,109,110],{},"另提供锚定 GlobalSign Root CA 的备选链",[112,113,114],"h3",{"id":114},"关键事件时间线",[14,116,117],{},"兼容性格局近几年被几次官方事件重塑，任何没纳入这些节点的对比都是过时的（表末「引述来源」列为官方原文链接）：",[58,119,120,136],{},[61,121,122],{},[64,123,124,127,130,133],{},[67,125,126],{},"时间",[67,128,129],{},"事件",[67,131,132],{},"影响",[67,134,135],{},"引述来源",[80,137,138,160,179,200,219],{},[64,139,140,143,146,149],{},[85,141,142],{},"2021-09-30",[85,144,145],{},"Let's Encrypt 借道交叉签名的老根 DST Root CA X3 到期",[85,147,148],{},"老安卓的兼容开始依赖「扩展交叉签名」续命",[85,150,151],{},[152,153,159],"a",{"href":154,"className":155,"rel":157},"https:\u002F\u002Fletsencrypt.org\u002Fdocs\u002Fdst-root-ca-x3-expiration-september-2021\u002F",[156],"cite-link",[158],"nofollow","LE 官方文档",[64,161,162,165,168,171],{},[85,163,164],{},"2023-05",[85,166,167],{},"GTS ACME API 向所有用户免费开放",[85,169,170],{},"GTS 证书不再局限于 GCP 生态",[85,172,173],{},[152,174,178],{"href":175,"className":176,"rel":177},"https:\u002F\u002Fsecurity.googleblog.com\u002F2023\u002F05\u002Fgoogle-trust-services-acme-api_0503894189.html",[156],[158],"Google 安全博客",[64,180,181,184,187,192],{},[85,182,183],{},"2024-09-30",[85,185,186],{},"Let's Encrypt 扩展交叉签名到期",[85,188,189],{},[21,190,191],{},"Android 7.1.1 以下设备自此对 Let's Encrypt 证书报错",[85,193,194],{},[152,195,199],{"href":196,"className":197,"rel":198},"https:\u002F\u002Fcommunity.letsencrypt.org\u002Ft\u002Fproduction-chain-changes\u002F150739",[156],[158],"LE 官方社区帖",[64,201,202,205,208,211],{},[85,203,204],{},"2025-03",[85,206,207],{},"GTS 发布备选链：GTS Root R1 由 GlobalSign Root CA 交叉签名",[85,209,210],{},"官方明示「最大化兼容 legacy 客户端」，超老旧设备可借 1998 年老根建立信任",[85,212,213],{},[152,214,218],{"href":215,"className":216,"rel":217},"https:\u002F\u002Fdevelopers.google.com\u002Fpublic-key-infrastructure\u002Fupdates\u002Fmarch2025-alternate-chains",[156],[158],"Google PKI 更新页",[64,220,221,224,227,230],{},[85,222,223],{},"2026-01",[85,225,226],{},"Let's Encrypt 6 天短期证书与 IP 地址证书正式 GA",[85,228,229],{},"短期证书有效期 160 小时；IP 证书正式进入 LE 生产环境",[85,231,232],{},[152,233,237],{"href":234,"className":235,"rel":236},"https:\u002F\u002Fletsencrypt.org\u002F2026\u002F01\u002F15\u002F6day-and-ip-general-availability",[156],[158],"LE 官方公告",[10,239,241],{"id":240},"二兼容性对比三类设备切片一张表","二、兼容性对比：三类设备切片一张表",[58,243,244,258],{},[61,245,246],{},[64,247,248,251,254,256],{},[67,249,250],{},"设备切片",[67,252,253],{},"典型例子",[67,255,87],{},[67,257,101],{},[80,259,260,274,292],{},[64,261,262,265,268,271],{},[85,263,264],{},"现代环境",[85,266,267],{},"近 5 年的浏览器、iOS \u002F Android、主流云 SDK",[85,269,270],{},"✅ 完全信任",[85,272,273],{},"✅ 完全信任（google.com 同链）",[64,275,276,279,282,285],{},[85,277,278],{},"半 legacy",[85,280,281],{},"2016–2021 年间冻结的信任库：老 JDK 8 早期版本、老企业 Linux、嵌入式设备",[85,283,284],{},"✅ ISRG Root X1 在库内",[85,286,287,288,291],{},"⚠️ 默认链的 GTS 根不在库内；",[21,289,290],{},"下发备选链则可通过","（锚定几乎存在于所有历史信任库的 GlobalSign Root CA）",[64,293,294,297,300,303],{},[85,295,296],{},"超 legacy",[85,298,299],{},"Android 7.1.1 以下、2016 年前的信任库",[85,301,302],{},"❌ 2024-09-30 起不再受信任",[85,304,305],{},"✅ 备选链锚定 1998 年的 GlobalSign Root CA",[14,307,308],{},"两条实操提醒：",[310,311,312,319],"ul",{},[42,313,314,315,318],{},"表中后两行的 ⚠️ \u002F ✅ ",[21,316,317],{},"取决于服务端的链下发","：申请拿到的 fullchain 是否包含 GlobalSign 交叉签名路径因获取渠道而异，上线后应用 SSL Labs 等工具验证实际链路径",[42,320,321],{},"超 legacy 设备在绝大多数业务中占比极低；除非有明确的老旧设备用户群（POS 机、老机顶盒、工厂内嵌浏览器等），否则不必为这部分兼容性改变选型",[14,323,324,325,328,329,332,333,337],{},"但有一种情况例外：如果你的业务真实存在老旧设备用户，",[21,326,327],{},"Google Trust Services 证书是当前唯一能稳定覆盖 Android 7 及以下超老旧设备的免费选择","，值得认真考虑。而这恰恰是本平台的优势所在——多数证书申请渠道只支持 Let's Encrypt，想用 GTS 通常得自己注册 Google Cloud 账号并对接其 ACME 接口；在 HiOFD SSL 证书服务平台，",[21,330,331],{},"GTS 证书同样可以在线免费申请","，与 Let's Encrypt 完全同等的可视化流程，直达",[152,334,336],{"href":335},"\u002Ffree-ssl","免费申请页面","。",[10,339,341],{"id":340},"三自动化生态与证书能力对比","三、自动化生态与证书能力对比",[58,343,344,355],{},[61,345,346],{},[64,347,348,351,353],{},[67,349,350],{},"维度",[67,352,87],{},[67,354,101],{},[80,356,357,372,383,394,404,415,425,434],{},[64,358,359,362,365],{},[85,360,361],{},"ACME 协议",[85,363,364],{},"行业标准制定者，Certbot \u002F acme.sh 等客户端原生支持",[85,366,367,368],{},"支持，2023-05 起向所有用户免费开放（自行对接需 Google Cloud 账号）",[152,369,178],{"href":175,"className":370,"rel":371},[156],[158],[64,373,374,377,380],{},[85,375,376],{},"工具链与社区教程",[85,378,379],{},"最丰富，几乎所有主机面板原生集成，问题易搜到解法",[85,381,382],{},"相对少，以 GCP 官方文档为主",[64,384,385,388,391],{},[85,386,387],{},"GCP 生态集成",[85,389,390],{},"一般",[85,392,393],{},"与 Certificate Manager 深度集成，自动续签与部署",[64,395,396,399,402],{},[85,397,398],{},"默认有效期",[85,400,401],{},"90 天",[85,403,401],{},[64,405,406,409,412],{},[85,407,408],{},"短期证书",[85,410,411],{},"shortlived profile（160 小时≈6.7 天，2026-01 GA）",[85,413,414],{},"支持 ACME Profiles 替代档位",[64,416,417,420,423],{},[85,418,419],{},"通配符域名",[85,421,422],{},"✅",[85,424,422],{},[64,426,427,430,432],{},[85,428,429],{},"多域名",[85,431,422],{},[85,433,422],{},[64,435,436,439,441],{},[85,437,438],{},"IP 地址证书",[85,440,422],{},[85,442,443],{},"❌",[26,445,446],{},[14,447,448,449,337],{},"最后一行是硬约束：在本站支持的 5 家免费 CA 中，Let's Encrypt 是唯一支持 IP 地址证书的 CA。要保护的是公网 IP 而非域名时，没有第二个选择，见 ",[152,450,452],{"href":451},"\u002Fdocs\u002Fip-certificate","IP 地址证书申请指南",[26,454,455],{},[14,456,457,458,461],{},"关于「账号门槛」的说明：表中「自行对接需 Google Cloud 账号」指的是",[21,459,460],{},"自己直连 Google ACME API"," 的情形；在 HiOFD SSL 证书服务平台，CA 对接已由平台代完成——无论 Let's Encrypt 还是 GTS，网页上可视化申请即可，无需注册任何云账号、无需自己操作 ACME 命令。",[10,463,465],{"id":464},"四加密强度没有区别","四、加密强度：没有区别",[14,467,468,469,472],{},"两家均签发 DV（域名验证）证书，均支持 RSA 2048\u002F3072 与 ECDSA P-256，TLS 握手中使用的加密算法与密钥强度完全等价。",[21,470,471],{},"两家的差异从来不在加密强度，而在信任锚的分布与运营生态","——这正是前两节对比的内容，加密强度不应作为选型因素。",[10,474,476],{"id":475},"五选型建议按场景对号入座","五、选型建议：按场景对号入座",[58,478,479,492],{},[61,480,481],{},[64,482,483,486,489],{},[67,484,485],{},"你的场景",[67,487,488],{},"推荐",[67,490,491],{},"理由",[80,493,494,504,517,527,540],{},[64,495,496,499,501],{},[85,497,498],{},"普通网站、博客、API（用户以现代设备为主）",[85,500,87],{},[85,502,503],{},"生态最成熟、教程最多、排障最容易",[64,505,506,509,511],{},[85,507,508],{},"必须覆盖 Android 7 及以下等超老旧设备",[85,510,101],{},[85,512,513,516],{},[21,514,515],{},"覆盖超老旧设备的唯一免费选择","：备选链锚定 1998 年 GlobalSign 老根；上线后务必验证链下发",[64,518,519,522,524],{},[85,520,521],{},"保护公网 IP 地址",[85,523,87],{},[85,525,526],{},"本站唯一支持 IP 证书的 CA",[64,528,529,532,534],{},[85,530,531],{},"基础设施深度绑定 GCP",[85,533,101],{},[85,535,536,539],{},[21,537,538],{},"与 GCP 集成最深","：Certificate Manager 自动续签部署，运维最省心",[64,541,542,545,547],{},[85,543,544],{},"没有特殊约束、不想纠结",[85,546,87],{},[85,548,549],{},"默认推荐，也是本站申请页的默认选项",[14,551,552,553,556,557,561,562,564,565,337],{},"在 HiOFD SSL 证书服务平台，两家 CA 均可在申请时直接选择，且",[21,554,555],{},"Google Trust Services 证书同样完全免费","——其他多数渠道要么不支持 GTS、要么需自行对接 Google Cloud ACME，而本平台无需云账号、无需命令行。申请流程见 ",[152,558,560],{"href":559},"\u002Fdocs\u002Fgetting-started","5分钟申请你的第一张免费SSL证书","，或直接前往",[152,563,336],{"href":335},"；各 CA 的通配符与多域名支持矩阵见 ",[152,566,568],{"href":567},"\u002Fdocs\u002Fcert-types","证书类型选择指南",[10,570,571],{"id":571},"常见问题",[112,573,575],{"id":574},"lets-encrypt-证书会被浏览器警告吗","Let's Encrypt 证书会被浏览器警告吗？",[14,577,578],{},"现代浏览器与移动系统不会。仅 Android 7.1.1 以下的老设备自 2024-09-30 起会报错；若你的用户群体以现代设备为主，无需担心。",[112,580,582],{"id":581},"google-trust-services-证书真的免费吗","Google Trust Services 证书真的免费吗？",[14,584,585,586,591,592,595],{},"是。Google 于 2023 年 5 月将 GTS ACME API 向所有用户免费开放（自行对接需注册 Google Cloud 账号），引述：",[152,587,590],{"href":175,"className":588,"rel":589},[156],[158],"Google 安全博客公告","。而在本平台，GTS 的 CA 对接已代你完成：直接在页面申请即可，",[21,593,594],{},"无需注册 Google Cloud 账号、无需自己操作 ACME","——这也是使用平台服务相比自建 ACME 客户端的优势之一。",[112,597,599],{"id":598},"如何验证我的证书对目标设备兼容","如何验证我的证书对目标设备兼容？",[14,601,602,603,607],{},"用 SSL Labs 在线检测工具查看服务端实际下发的链路径（是否包含交叉签名备选链）；对关键 legacy 设备，最直接的方式是在该设备上实际访问一次，或用 ",[604,605,606],"code",{},"openssl s_client -connect"," 模拟握手验证。",[10,609,610],{"id":610},"结语",[310,612,613,619,625,631],{},[42,614,615,618],{},[21,616,617],{},"兼容性","：现代环境等价；超 legacy 环境 GTS 备选链反超，前提是服务端正确下发备选链",[42,620,621,624],{},[21,622,623],{},"生态","：Let's Encrypt 是自动化事实标准；GTS 凭开放 ACME 与 GCP 集成占据自己的生态位",[42,626,627,630],{},[21,628,629],{},"能力","：IP 证书是 Let's Encrypt 的独占区",[42,632,633,636],{},[21,634,635],{},"加密强度","：两者无区别，不构成选型因素",[14,638,639,640,643],{},"对绝大多数网站而言，",[21,641,642],{},"闭眼选 Let's Encrypt"," 仍是正确答案；只有当业务真实存在老旧设备兼容需求时，GTS 的备选链才具有不可替代的价值。",[14,645,646],{},"相关阅读：",[310,648,649,653,659,663],{},[42,650,651],{},[152,652,560],{"href":559},[42,654,655],{},[152,656,658],{"href":657},"\u002Fdocs\u002Fcore-concepts","核心概念：SSL证书、DV\u002FOV\u002FEV 与 ACME",[42,660,661],{},[152,662,452],{"href":451},[42,664,665],{},[152,666,668],{"href":667},"\u002Fblog\u002Ffree-https-certificate-guide","免费HTTPS证书在线申请教程：从申请到Nginx部署",{"title":670,"searchDepth":671,"depth":672,"links":673},"",2,3,[674,675,678,679,680,681,682,687],{"id":12,"depth":671,"text":12},{"id":33,"depth":671,"text":34,"children":676},[677],{"id":114,"depth":672,"text":114},{"id":240,"depth":671,"text":241},{"id":340,"depth":671,"text":341},{"id":464,"depth":671,"text":465},{"id":475,"depth":671,"text":476},{"id":571,"depth":671,"text":571,"children":683},[684,685,686],{"id":574,"depth":672,"text":575},{"id":581,"depth":672,"text":582},{"id":598,"depth":672,"text":599},{"id":610,"depth":671,"text":610},null,"2026-09-10",false,"md",{},true,"\u002Fblog\u002Flets-encrypt-vs-google-trust-services",{"title":5,"description":670},{"loc":694},"blog\u002Flets-encrypt-vs-google-trust-services","Let's Encrypt 与 Google Trust Services 是当前最主流的两家免费 DV 证书颁发机构。本文基于根证书信任库与官方链公告的一手信息，按现代、半 legacy、超 legacy 三类设备切片对比两者兼容性，并比较自动化生态与证书能力，给出分场景选型建议。",[700,87,101],"免费SSL证书选型","eJ2kjQo60fPRx_FtHQr36ICghIelIHDyQ6NlNShk-go",[703,704],{"path":694,"title":5,"datePublished":689},{"path":667,"title":668,"datePublished":705},"2026-07-26",1789011271263]