I think you're missing a number of important things here. We operate on a pretty small budget for what we provide. I doubt you'd be happy with a CA that operate

I think you're missing a number of important things here. We operate on a pretty small budget for what we provide. I doubt you'd be happy with a CA that operated with a smaller budget. 1) Our software is already open source. That doesn't mean we get the development work that we need when we need it for free. We are constantly working on various features and fixes that need to be deployed weekly if not more often, and usually based on a close working relationship with our operations team. Security fixes need to be produced in hours or less, not when a volunteer contributor gets around to it. Our engineers also spend a lot of time every day digging through hundreds of GB of logs to find or verify service issues. Keep in mind that our software is deployed by very few people other than us, because in order for our software to be useful you need to have done a massive amount of other (expensive) work to set up the legal, compliance, and technical context. 2) I'm not sure where you get 60k requests per day as a representation of our system load. Between ACME API interactions and OCSP it's many millions. 3) The CA needs to be monitored 24/7. Our infrastructure is necessarily more complicated than your average web API or application, and it's constantly being maintained and improved. Open sourcing doesn't address the issue of having highly qualified and trained staff building and monitoring secure systems. 4) There is a huge amount of tedious compliance and legal work that has to be done in order for us to continue to operate. 5) We operate in a compliance environment (WebTrust/BRs/root program rules). We have a lot of obligations, mostly for good reasons, that make what we're doing very different from "write some code, throw it on GitHub, deploy on a cloud service and be done with it."