4 ms·

Curious where the 20K a month in hosting is spent? Perhaps Google or Amazon could throw in some credits to help out?

• dublinben 10y ago
  It is almost certainly necessary for them to have dedicated hardware in neutral datacenters. They can't just run their infrastructure on AWS or Google.
  • artimaeis 10y ago
    Maybe there's something very obvious I'm missing - but why? If their environments are not bare-metal then moving from a virtual solution to a cloud one seems fairly simple. If they are bare-metal then it hardly seems necessary for issuing certs - but if you have more insight I'd love if you'd share it!
    • detaro 10y ago
      CAs require special hardware security modules (HSM) to contain the signing keys and have to control the entire path to them, so yes, you need to own your hardware for a public CA. And independence from their sponsors is an important organisational feature for Let's Encrypt.
      • fireflash38 10y ago
        The second part of it is why they can't use cloud HSM products offered by various companies. If you're functioning as a CA, you absolutely want restricted physical access to your root keys, which you can't guarantee otherwise.
    • nixgeek 10y ago
      Security sensitive workloads are often not virtualised because it opens them up to "What are the other virtual machines doing?". There've been a number of Xen and KVM issues over the years, including a couple which may have resulted in a bad actor having access to the hypervisor (and thus, all its guests). Attacks like Rowhammer also play in this space.