4 ms·

Think that's part of it - a substantial amount of the web is on shared hosting (and probably dictated by other areas of the business) and as such wont have any

Think that's part of it - a substantial amount of the web is on shared hosting (and probably dictated by other areas of the business) and as such wont have any level of root access. Therefore the hosting company can control cert installation and thus cost.

rando444 10y ago
You don't need root access. We run a cpanel server and have a let's encrypt plugin that allows users to generate and install their own certificates.
- wastedhours 10y ago
  Usually add-ons are administered by the hosting company though (?) - so if they want to own the cert purchase/installation flow, then they can certainly do that.
  - chris_wot 10y ago
    Don't use a hosting company who does that. Take your money and spend it elsewhere.
    - ubernostrum 10y ago
      These hosting companies are already doing enough things "wrong" that if "well, everybody just stop using them" were going to be a viable strategy it would have worked by now for those other things. We currently do not have the power to change the behavior or the market share of these hosting companies in any significant way. That leaves working around their behavior as the option.
      - chris_wot 10y ago
        Who said anything about doing it to change their behaviour? Do it because you aren't getting value for money! If there are better alternatives, then use them.
  - niij 10y ago
    If you have a shell and public I address, you can get a certificate. Root access is only required for Http authentication, you can also authenticate to LE using DNS. I actually just learned about the DNA ability. Check out Lego project, it makes DNS Auth very easy :)
angry-hacker 10y ago
Extra effort + more computing power, I don't think cheap shared hosting companies are too interested.
- marcosdumay 10y ago
  It's called "competition". Clients can make sure the ones not too interested become very interested in a few easy steps.
  - angry-hacker 10y ago
    When we are talking about cheap shared hosting providers, the only competition is price and it's driven extremely low. Competition can only kick in when browsers go crazy about plain text etc.
    - marcosdumay 10y ago
      Well, if the client doesn't care about that warning, why should the provider care? As I said, there are easy steps clients can use to make their provider care. But if the clients themselves don't care, nobody will.
- laurentdc 10y ago
  The performance impact of HTTPS is negligible. Article from 2010: https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html https://www.imperialviolet.org/2010/06/25/overclocking-ssl.h...

rando444 10y ago

You don't need root access. We run a cpanel server and have a let's encrypt plugin that allows users to generate and install their own certificates.

wastedhours 10y ago
Usually add-ons are administered by the hosting company though (?) - so if they want to own the cert purchase/installation flow, then they can certainly do that.
- chris_wot 10y ago
  Don't use a hosting company who does that. Take your money and spend it elsewhere.
  - ubernostrum 10y ago
    These hosting companies are already doing enough things "wrong" that if "well, everybody just stop using them" were going to be a viable strategy it would have worked by now for those other things. We currently do not have the power to change the behavior or the market share of these hosting companies in any significant way. That leaves working around their behavior as the option.
    - chris_wot 10y ago
      Who said anything about doing it to change their behaviour? Do it because you aren't getting value for money! If there are better alternatives, then use them.
- niij 10y ago
  If you have a shell and public I address, you can get a certificate. Root access is only required for Http authentication, you can also authenticate to LE using DNS. I actually just learned about the DNA ability. Check out Lego project, it makes DNS Auth very easy :)

angry-hacker 10y ago

Extra effort + more computing power, I don't think cheap shared hosting companies are too interested.

marcosdumay 10y ago
It's called "competition". Clients can make sure the ones not too interested become very interested in a few easy steps.
- angry-hacker 10y ago
  When we are talking about cheap shared hosting providers, the only competition is price and it's driven extremely low. Competition can only kick in when browsers go crazy about plain text etc.
  - marcosdumay 10y ago
    Well, if the client doesn't care about that warning, why should the provider care? As I said, there are easy steps clients can use to make their provider care. But if the clients themselves don't care, nobody will.
laurentdc 10y ago
The performance impact of HTTPS is negligible. Article from 2010: https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html https://www.imperialviolet.org/2010/06/25/overclocking-ssl.h...