3 ms·

If you're running a commercial entity and $50/year is a problem for you, then I'd suggest that your business may have its challenges. Obviously it is (in most

If you're running a commercial entity and $50/year is a problem for you, then I'd suggest that your business may have its challenges. Obviously it is (in most cases) possible to automate the cert creation process using let's encrypt for free, so it's a trade-off on whether the time it takes to do that is worth more or less than the $50 it'd cost to purchase a wildcard cert. As to the compute power you can buy for that, it could be that says more about the cheapness of compute power than it does about the expense of SSL certs. As to Let's encrypt running for free, well the post I was referring to indicated they didn't want to go that route, also you do know they're actively soliciting donations at the moment because, guess what, you can't run a CA for free...

Kadin 10y ago
> If you're running a commercial entity Making the web open only to commercial entities is a huge problem by itself. I definitely would not want to make that a premise or assumption to participate in the Internet as an equal player.
byuu 10y ago
I'm not. I'm running byuu.org without any ads, and without selling any products. I used to spend about 60 hours a week coding, nowadays it's more like 20 hours a week, and recoup only the occasional donation or licensing agreement (they reach out to me) for my software. If you were to weigh it against the hours I've put into things, I'm earning about $0.60 an hour for my work. And if you consider my own personal expenses on my projects, I'm at about -$30,000 in total. But I have fun doing it (occasional trolling aside), so it's worth the cost. I wasn't willing to accept the Let's Encrypt limitations, and so I paid for a three-year AlphaSSL wildcard certificate for ... I believe $132 or so. > As to the compute power you can buy for that, it could be that says more about the cheapness of compute power than it does about the expense of SSL certs. Not really. There is absolutely no reason it should cost $5 to run openssl with a SAN of "www.byuu.org" and $50 to run openssl with a SAN of "*.byuu.org" -- the verification process is 100% identical for both. That is 100% pure, unadulterated greed. They charge that rate because they can. > because, guess what, you can't run a CA for free... I know, the auditing fees are obscenely expensive and required every six months. Google could afford it if they want the web to be 100% HTTPS. It wouldn't even be a drop in the bucket for them. It'd be a fraction of a sliver of a drop.

Kadin 10y ago

> If you're running a commercial entity Making the web open only to commercial entities is a huge problem by itself. I definitely would not want to make that a premise or assumption to participate in the Internet as an equal player.

byuu 10y ago

I'm not. I'm running byuu.org without any ads, and without selling any products. I used to spend about 60 hours a week coding, nowadays it's more like 20 hours a week, and recoup only the occasional donation or licensing agreement (they reach out to me) for my software. If you were to weigh it against the hours I've put into things, I'm earning about $0.60 an hour for my work. And if you consider my own personal expenses on my projects, I'm at about -$30,000 in total. But I have fun doing it (occasional trolling aside), so it's worth the cost. I wasn't willing to accept the Let's Encrypt limitations, and so I paid for a three-year AlphaSSL wildcard certificate for ... I believe $132 or so. > As to the compute power you can buy for that, it could be that says more about the cheapness of compute power than it does about the expense of SSL certs. Not really. There is absolutely no reason it should cost $5 to run openssl with a SAN of "www.byuu.org" and $50 to run openssl with a SAN of "*.byuu.org" -- the verification process is 100% identical for both. That is 100% pure, unadulterated greed. They charge that rate because they can. > because, guess what, you can't run a CA for free... I know, the auditing fees are obscenely expensive and required every six months. Google could afford it if they want the web to be 100% HTTPS. It wouldn't even be a drop in the bucket for them. It'd be a fraction of a sliver of a drop.