6 ms·

Even if this is true, nothing prevents another provider from rolling out a similar or better offer. Existing providers could do it today, but they are too busy

Even if this is true, nothing prevents another provider from rolling out a similar or better offer. Existing providers could do it today, but they are too busy spreading FUD to rake in profit.

patmorgan23 7y ago
Yeah the software is open source, any other CA has the ability to pick it up ajd implement a similar service.
- brianwawok 7y ago
  Yup, but no incentive. They are literally making millions of dollars for a fraction of a penny in CPU time to sign a cert. Why offer the same thing for free? Try to sell it as more secure and trick lots of people...
  - rickycook 7y ago
    who ever said free? they could make a paid service like LE with automated renewals etc that integrates better with enterprise software, or that does better audit logging, or any number of things. let’s encrypt is a great service, but there’s still plenty of money to be made off overzealous corporate security policies
- jaas 7y ago
  Just so people don't get an oversimplified view of what it takes to start a CA from this comment, you will have much bigger challenges than access to application software. Your first issue will be securing millions of dollars per year for the staff that it takes to run the CA responsibly. Your next issue will be getting trusted by browsers. Also, the open source Let's Encrypt CA software is tailored for how we do things. It's not an "off the shelf" component that you can easily run in another context and end up with a proper compliant CA.
  - Dylan16807 7y ago
    Well, that's why the comment is "any other CA" rather than "anyone". Starting yet another CA is definitely not to be taken lightly.
  - aidenn0 7y ago
    How is LE funded? [edit] At least partly through corporate sponsership: https://www.abetterinternet.org/sponsors/ https://www.abetterinternet.org/sponsors/
  - mmalone 7y ago
    What do you think is a realistic estimate to get a new CA off the ground? Just the minimal cost for hardware and audits and whatnot to create the required artifacts and get them into the three major root programs. Not including staff and ongoing operational expenses (I can estimate that myself). I’ve heard it can be done for as little as $250,000. Also, timeline. It took Let’s Encrypt a couple years to get in root programs and have good penetration, right? Would it be faster or slower now? If someone was willing to undergo this ordeal and could secure funding so it wouldn’t split the philanthropic community and affect LE, would LE be willing to cross-sign (once they’re in good standing) to get them off the ground, the way IdenTrust did for the ISRG roots? Asking for a friend ;)
    - Ayesh 7y ago
      Not much: https://bugzilla.mozilla.org/show_bug.cgi?id=647959 https://bugzilla.mozilla.org/show_bug.cgi?id=647959 It's not about the money, either. LetsEncrypt had their intermediate certificates cross-signed by IdenTrust, otherwise they wouldn't have the 30% market share. It takes a lot of time with the CA application process. You will need to convince Microsoft, Apple, Mozilla, Java, etc that you will be a good CA with good practices. Multiple security audits (starting at about $40K... KPMG don't come cheap), hardware (HSM, servers for validation, OCSP, CT, etc) and people (needs to be trusted people, and often are paid top dollars). It's easy to _buy_ a CA than creating one. You can get your new root certificates included later easily now that you have a root already, from which you can cross-sign until they are included. CAs are sold out more often than many of us think.

Even if this is true, nothing prevents another provider from rolling out a similar or better offer. Existing providers could do it today, but they are too busy spreading FUD to rake in profit.

patmorgan23 7y ago

Yeah the software is open source, any other CA has the ability to pick it up ajd implement a similar service.

brianwawok 7y ago
Yup, but no incentive. They are literally making millions of dollars for a fraction of a penny in CPU time to sign a cert. Why offer the same thing for free? Try to sell it as more secure and trick lots of people...
- rickycook 7y ago
  who ever said free? they could make a paid service like LE with automated renewals etc that integrates better with enterprise software, or that does better audit logging, or any number of things. let’s encrypt is a great service, but there’s still plenty of money to be made off overzealous corporate security policies
jaas 7y ago
Just so people don't get an oversimplified view of what it takes to start a CA from this comment, you will have much bigger challenges than access to application software. Your first issue will be securing millions of dollars per year for the staff that it takes to run the CA responsibly. Your next issue will be getting trusted by browsers. Also, the open source Let's Encrypt CA software is tailored for how we do things. It's not an "off the shelf" component that you can easily run in another context and end up with a proper compliant CA.
- Dylan16807 7y ago
  Well, that's why the comment is "any other CA" rather than "anyone". Starting yet another CA is definitely not to be taken lightly.
- aidenn0 7y ago
  How is LE funded? [edit] At least partly through corporate sponsership: https://www.abetterinternet.org/sponsors/ https://www.abetterinternet.org/sponsors/
- mmalone 7y ago
  What do you think is a realistic estimate to get a new CA off the ground? Just the minimal cost for hardware and audits and whatnot to create the required artifacts and get them into the three major root programs. Not including staff and ongoing operational expenses (I can estimate that myself). I’ve heard it can be done for as little as $250,000. Also, timeline. It took Let’s Encrypt a couple years to get in root programs and have good penetration, right? Would it be faster or slower now? If someone was willing to undergo this ordeal and could secure funding so it wouldn’t split the philanthropic community and affect LE, would LE be willing to cross-sign (once they’re in good standing) to get them off the ground, the way IdenTrust did for the ISRG roots? Asking for a friend ;)
  - Ayesh 7y ago
    Not much: https://bugzilla.mozilla.org/show_bug.cgi?id=647959 https://bugzilla.mozilla.org/show_bug.cgi?id=647959 It's not about the money, either. LetsEncrypt had their intermediate certificates cross-signed by IdenTrust, otherwise they wouldn't have the 30% market share. It takes a lot of time with the CA application process. You will need to convince Microsoft, Apple, Mozilla, Java, etc that you will be a good CA with good practices. Multiple security audits (starting at about $40K... KPMG don't come cheap), hardware (HSM, servers for validation, OCSP, CT, etc) and people (needs to be trusted people, and often are paid top dollars). It's easy to _buy_ a CA than creating one. You can get your new root certificates included later easily now that you have a root already, from which you can cross-sign until they are included. CAs are sold out more often than many of us think.