4 ms·

Honest question: is there a catch? Why do all the other CAs cost so much and take so long when the actual cert is generated in seconds? Isn't that how it's su

by nickpp 10y ago

Honest question: is there a catch? Why do all the other CAs cost so much and take so long when the actual cert is generated in seconds? Isn't that how it's supposed to work and LE is breaking the rules, thus living on borrowed time? If it was possible to be so easy why no else did it? What is the secret ingredient?

user5994461 10y ago
Why do banknotes costs so much? It's just a stupid paper made up of cotton with ink on top. Because some agencies have the monopole to print them and they've made it very difficult for anyone else to get into that printing business and it turns out that that product is valuable to a lot of people and they're willing to assign a lot of money to it.
K0nserv 10y ago
It depends on the level of certification done. If you are getting a regular SSL cert you only need to prove ownership of the domain, which can be automated easily and requires no human work. However EV(Extended Validation)[0] certificates involve a lot more due diligence on the part of the issuer. EV certs require validation of the legal entity behind the domain and this is requires work to be done by a human. AFAIK the cost of previous SSL certs have been largely artificial. Obviously running servers and paying staff to keep an automated process in place isn't free, but I recon the cost has always been inflated quite a bit. There's also an artificial scarcity introduced because not everyone can start a CA and getting a root certificated trusted is non trivial. Let's Encrypt is sponsored so they do make some money, but this allows them to issue certs for free. 0: https://en.wikipedia.org/wiki/Extended_Validation_Certificate https://en.wikipedia.org/wiki/Extended_Validation_Certificat...
seibelj 10y ago
It takes a lot of work and isn't something someone in their college dorm room can make. It takes industry contacts, specialized skills, and solid marketing to build a network and trust in the system. To do this for nonprofit is a sacrifice when the people with these skills could be chasing big money. LE is a good example of the tech community doing something that probably a government agency should be doing with tax dollars to support the industry. Private sector altruism.
pfg 10y ago
> Why do all the other CAs cost so much and take so long when the actual cert is generated in seconds? I guess "so much" should be put in perspective: Domain Validation certificates, like the ones Let's Encrypt issue, are not really expensive - resellers typically offer them for something like $10/year. The more expensive certificates - OV and EV - involve some degree of manual verification of the information on the certificate (such as the company name). That's a large part of the cost. But yeah, commercial CAs are (were?) money printing machines. Running Let's Encrypt costs about $3M/year, and they support >20M active certificates. Commercial CAs are going to have some marketing and support expenses, but the rest would be profit. > Isn't that how it's supposed to work and LE is breaking the rules, thus living on borrowed time? All CAs (should) follow the same set of rules - the Baseline Requirements. Let's Encrypt has had a pretty good track record so far - definitely better than some of the big commercial CAs like Symantec or Comodo. > If it was possible to be so easy why no else did it? What is the secret ingredient? To be fair, they were not the first free CA - both StartSSL and WoSign offered free DV certificates (for non-commercial usage). Not the best examples, I suppose. Cloudflare offered free SSL (via Comodo) for their customers as well, as does cPanel via AutoSSL It's definitely viable, just took some time for people to care enough about encrypting the web to make it happen.
- e12e 10y ago
  > But yeah, commercial CAs are (were?) money printing machines. Which is how we got Canonical/Ubuntu (and how Shuttleworth could afford to be a space tourist): https://en.wikipedia.org/wiki/Thawte https://en.wikipedia.org/wiki/Thawte
quickben 10y ago
Well, it captures the niche target userbase that would otherwise self-sign a certificate to protect the channel. It's a lot easier to push Lets Encrypt for the master keys, than go after N people that would go through the trouble to generate a self signed cert to secure the channel.

by nickpp 10y ago

user5994461 10y ago

Why do banknotes costs so much? It's just a stupid paper made up of cotton with ink on top. Because some agencies have the monopole to print them and they've made it very difficult for anyone else to get into that printing business and it turns out that that product is valuable to a lot of people and they're willing to assign a lot of money to it.

K0nserv 10y ago

It depends on the level of certification done. If you are getting a regular SSL cert you only need to prove ownership of the domain, which can be automated easily and requires no human work. However EV(Extended Validation)[0] certificates involve a lot more due diligence on the part of the issuer. EV certs require validation of the legal entity behind the domain and this is requires work to be done by a human. AFAIK the cost of previous SSL certs have been largely artificial. Obviously running servers and paying staff to keep an automated process in place isn't free, but I recon the cost has always been inflated quite a bit. There's also an artificial scarcity introduced because not everyone can start a CA and getting a root certificated trusted is non trivial. Let's Encrypt is sponsored so they do make some money, but this allows them to issue certs for free. 0: https://en.wikipedia.org/wiki/Extended_Validation_Certificate https://en.wikipedia.org/wiki/Extended_Validation_Certificat...

seibelj 10y ago

It takes a lot of work and isn't something someone in their college dorm room can make. It takes industry contacts, specialized skills, and solid marketing to build a network and trust in the system. To do this for nonprofit is a sacrifice when the people with these skills could be chasing big money. LE is a good example of the tech community doing something that probably a government agency should be doing with tax dollars to support the industry. Private sector altruism.

pfg 10y ago

> Why do all the other CAs cost so much and take so long when the actual cert is generated in seconds? I guess "so much" should be put in perspective: Domain Validation certificates, like the ones Let's Encrypt issue, are not really expensive - resellers typically offer them for something like $10/year. The more expensive certificates - OV and EV - involve some degree of manual verification of the information on the certificate (such as the company name). That's a large part of the cost. But yeah, commercial CAs are (were?) money printing machines. Running Let's Encrypt costs about $3M/year, and they support >20M active certificates. Commercial CAs are going to have some marketing and support expenses, but the rest would be profit. > Isn't that how it's supposed to work and LE is breaking the rules, thus living on borrowed time? All CAs (should) follow the same set of rules - the Baseline Requirements. Let's Encrypt has had a pretty good track record so far - definitely better than some of the big commercial CAs like Symantec or Comodo. > If it was possible to be so easy why no else did it? What is the secret ingredient? To be fair, they were not the first free CA - both StartSSL and WoSign offered free DV certificates (for non-commercial usage). Not the best examples, I suppose. Cloudflare offered free SSL (via Comodo) for their customers as well, as does cPanel via AutoSSL It's definitely viable, just took some time for people to care enough about encrypting the web to make it happen.

e12e 10y ago
> But yeah, commercial CAs are (were?) money printing machines. Which is how we got Canonical/Ubuntu (and how Shuttleworth could afford to be a space tourist): https://en.wikipedia.org/wiki/Thawte https://en.wikipedia.org/wiki/Thawte

quickben 10y ago

Well, it captures the niche target userbase that would otherwise self-sign a certificate to protect the channel. It's a lot easier to push Lets Encrypt for the master keys, than go after N people that would go through the trouble to generate a self signed cert to secure the channel.