4 ms·

While Letsencrypt is doing a good thing, but what if it will stop issuing free certificates?

by codedokode 9y ago

dsr_ 9y ago
Then we will not be worse off than we were before.
- dtech 9y ago
  We would be better off, since there now exists a protocol and extensive tooling for automatic certificate management. This allows a competitor (even a commercial) one to fill in the gap left by letsencrypt if they stop issuing certs.
- perlgeek 9y ago
  In the short term, some will be worse off, because their current certificates will be valid somewhere between 30 and 90 days, instead of the 0 to 365 that is common with traditional certificates. Still, it's worth it. I have some private sites that now have TLS thanks to let's encrypt, which were plain HTTP before. I still wish for a second free, automated CA. Just to have redundancy.
cpach 9y ago
Why would they?
- bryanlarsen 9y ago
  They would if they ran out of money. There's a donate button at the bottom of the post...
  - kristofferR 9y ago
    LetsEncrypt has, as the post said, a super tiny (compared to their massive positive impact) budget of just $3 million dollars and the largest companies of the web as backers. They're never gonna run of of founds - their backers (Mozilla, Akamai, OVH, Cisco, Google, EFF,++++) would never let them.
- hinkley 9y ago
  I could see a situation where, for instance, they do a security audit and are convinced that they need to significantly up their physical or network security to prevent a potential attack. There's also the possibility of their competitors pushing an agenda with standards bodies that pushes up the cost of PKI to try to freeze them out. If they charged a token amount I don't think it would be so bad (except for the whole getting it through the bean counters problem), but it would be more lucrative for them to charge people money for raising the rate limits in their system. Certain people like Akamai are charging exorbitant amounts to manage large numbers of SSL certificates. Just look at their quarterly revenue, it's insane. Other providers could partner with LetsEncrypt and undercut them substantially enough that they could steal customers, but it might mean LetsEncrypt has to scale up their operational limits to do so.

While Letsencrypt is doing a good thing, but what if it will stop issuing free certificates?

dsr_ 9y ago

Then we will not be worse off than we were before.

dtech 9y ago
We would be better off, since there now exists a protocol and extensive tooling for automatic certificate management. This allows a competitor (even a commercial) one to fill in the gap left by letsencrypt if they stop issuing certs.
perlgeek 9y ago
In the short term, some will be worse off, because their current certificates will be valid somewhere between 30 and 90 days, instead of the 0 to 365 that is common with traditional certificates. Still, it's worth it. I have some private sites that now have TLS thanks to let's encrypt, which were plain HTTP before. I still wish for a second free, automated CA. Just to have redundancy.

cpach 9y ago

Why would they?

bryanlarsen 9y ago
They would if they ran out of money. There's a donate button at the bottom of the post...
- kristofferR 9y ago
  LetsEncrypt has, as the post said, a super tiny (compared to their massive positive impact) budget of just $3 million dollars and the largest companies of the web as backers. They're never gonna run of of founds - their backers (Mozilla, Akamai, OVH, Cisco, Google, EFF,++++) would never let them.
hinkley 9y ago
I could see a situation where, for instance, they do a security audit and are convinced that they need to significantly up their physical or network security to prevent a potential attack. There's also the possibility of their competitors pushing an agenda with standards bodies that pushes up the cost of PKI to try to freeze them out. If they charged a token amount I don't think it would be so bad (except for the whole getting it through the bean counters problem), but it would be more lucrative for them to charge people money for raising the rate limits in their system. Certain people like Akamai are charging exorbitant amounts to manage large numbers of SSL certificates. Just look at their quarterly revenue, it's insane. Other providers could partner with LetsEncrypt and undercut them substantially enough that they could steal customers, but it might mean LetsEncrypt has to scale up their operational limits to do so.