5 ms·

The lack of an obvious revenue source feels like the business equivalent of a code smell. Let's Encrypt is clearly being run as a charity - with a list of spons

The lack of an obvious revenue source feels like the business equivalent of a code smell. Let's Encrypt is clearly being run as a charity - with a list of sponsors that are paying for this. No obvious revenue stream feels like it's a recipe for something that's going to go poof rather quickly.

DyslexicAtheist 9y ago
this also turned me off. It's backed by a for-profit company which can be sold/acquired anytime. If we have learned anything from DigiNotar, Startcom, etc? Trust is a dangerous commodity to have changing hands. Anyway scrolling down to the bottom¹ they seem to be resellers for DigiCert/Symantec certificates. So based on their strategy to fish for users with free certificates, I'd strongly question both their motives and their track record with handling the technical requirements for operating a CA. If they are a serious actor in this space then they should at the very least have either ETSI TSP² or WebTrust³ certifications to meet the security/trust requirements for operating a CA. Judging from the info on this site, I doubt they do. ¹ https://www.certcenter.com/company/terms https://www.certcenter.com/company/terms ² https://portal.etsi.org/tbsitemap/esi/trustserviceproviders.aspx https://portal.etsi.org/tbsitemap/esi/trustserviceproviders.... ³ http://www.webtrust.org/item64428.aspx http://www.webtrust.org/item64428.aspx
- vtlynch 9y ago
  >they seem to be resellers for DigiCert/Symantec certificates >they should at the very least have either ETSI TSP² or WebTrust³ certifications to meet the security/trust requirements for operating a CA A reseller does not need to meet any of these certifications. Resellers have a business relationship with a CA, and all the steps related to certificate verification and issuance are handled by that CA. On the backend, a certificate request for your site is handled the same by the CA whether if comes through a reseller or through them directly.
fredsted 9y ago
Also, they don't say which person(s) are actually running the company: https://www.certcenter.com/company/imprint https://www.certcenter.com/company/imprint I actually thought that was a legal requirement in Germany.
- skrause 9y ago
  They do on the German site: https://www.certcenter.de/company/imprint https://www.certcenter.de/company/imprint
thiagocsf 9y ago
Not to mention SSL shouldn’t be on anywhere anymore. Such a misnomer.

DyslexicAtheist 9y ago

this also turned me off. It's backed by a for-profit company which can be sold/acquired anytime. If we have learned anything from DigiNotar, Startcom, etc? Trust is a dangerous commodity to have changing hands. Anyway scrolling down to the bottom¹ they seem to be resellers for DigiCert/Symantec certificates. So based on their strategy to fish for users with free certificates, I'd strongly question both their motives and their track record with handling the technical requirements for operating a CA. If they are a serious actor in this space then they should at the very least have either ETSI TSP² or WebTrust³ certifications to meet the security/trust requirements for operating a CA. Judging from the info on this site, I doubt they do. ¹ https://www.certcenter.com/company/terms https://www.certcenter.com/company/terms ² https://portal.etsi.org/tbsitemap/esi/trustserviceproviders.aspx https://portal.etsi.org/tbsitemap/esi/trustserviceproviders.... ³ http://www.webtrust.org/item64428.aspx http://www.webtrust.org/item64428.aspx

vtlynch 9y ago
>they seem to be resellers for DigiCert/Symantec certificates >they should at the very least have either ETSI TSP² or WebTrust³ certifications to meet the security/trust requirements for operating a CA A reseller does not need to meet any of these certifications. Resellers have a business relationship with a CA, and all the steps related to certificate verification and issuance are handled by that CA. On the backend, a certificate request for your site is handled the same by the CA whether if comes through a reseller or through them directly.

fredsted 9y ago

Also, they don't say which person(s) are actually running the company: https://www.certcenter.com/company/imprint https://www.certcenter.com/company/imprint I actually thought that was a legal requirement in Germany.

skrause 9y ago
They do on the German site: https://www.certcenter.de/company/imprint https://www.certcenter.de/company/imprint

thiagocsf 9y ago

Not to mention SSL shouldn’t be on anywhere anymore. Such a misnomer.