3 ms·
To put things in perspective, a typical certificate is a few kilobytes. Let’s say 10KB of network traffic to process one certificate. This is just 3.5 Mbps, an
by jiggawatts 3y ago
To put things in perspective, a typical certificate is a few kilobytes. Let’s say 10KB of network traffic to process one certificate.
This is just 3.5 Mbps, and we’re all “very impressed” that it’s being provided for free.
A Raspberry Pi could serve this.
Certificate Authorities have convinced everyone that their service is so onerously difficult to provide that they deserve billions of dollars… annually.
The reality is that they are pure rent-seekers, charging $50 for something that can be provided for free from a fanless hobby computer.
I just want everyone to have some perspective next time you go buy a wildcard certificate for a thousand dollars, which differs from a normal certificate by just four bytes.
Count the dollars per byte.
- x86a 3y agoTo be fair, I doubt bandwidth has ever been a significant cost driver for CAs
- jiggawatts 3y agoGreed has been the cost driver, which is why plugging "*.domain.com" into the subject field instead of "domain.com" costs 10x more money. DigiCert for example is owned by private venture capitalists. They expect as much rent-seeking as possible to get a return on their investment.
- ehPReth 3y agoCool. But what do the HSMs, auditing, etc, etc, etc that the BRs (https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-v2.0.0.pdf https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...) and root store policies require cost on top of “just some bytes”? FreeFreeFreeCerts (https://bugzilla.mozilla.org/show_bug.cgi?id=233458 https://bugzilla.mozilla.org/show_bug.cgi?id=233458) or Honest Achmed’s certificate authority (https://bugzilla.mozilla.org/show_bug.cgi?id=647959 https://bugzilla.mozilla.org/show_bug.cgi?id=647959) won’t make it in today’s world, nor yesterday’s. Let’s Encrypt’s financials are public and they aren’t running it off a singular Raspberry PI, nor anything like it - because they can’t; nor would it responsible to, at least on, say, a HSM or key seperation level. Not to say, though, that traditional CAs aren’t rent seeking bloated greedy pieces of shit - because they absolutely are. I’m happy Let’s Encrypt found the funding and will (and the all important cross-sign) to take off and curb stomp the incumbent CAs around a bit. I still cringe every time I see an OV certificate in the wild.
- BrandoElFollito 3y agoYou can have wildcard certificates from LE too.