4 ms·

Buypass discontinues issuance of TLS/SSL certificates

48 points by gpi 1y ago

yogorenapan 1y ago
Beyond the big players like Digicert, I'm surprised smaller companies have survived LetsEncrypt for this long. They mentioned it in this post ad well, most are moving towards free providers. I wonder if we'll see more shutting down in the next few years. One thing I think they could compete on is validity period as LetsEncrypt keeps lowering theirs
- bityard 1y ago
  It's good that LetsEncrypt has eaten into the CA racket. Demanding money from people in exchange for a specific sequence of bits just to be able to host (even self-host) content securely on the web never should have been allowed in the first place.
- Kwpolska 1y ago
  Browsers also keep lowering the maximum validity period: https://www.theregister.com/2025/04/14/ssl_tls_certificates/ https://www.theregister.com/2025/04/14/ssl_tls_certificates/
  - nickf 1y ago
    Not just browsers, CAs voted in favour too.
    - michaelt 1y ago
      To me, this seemed like turkeys voting for Christmas. Plenty of businesses with legacy systems will happily pay $300/year for a 1-year SSL certificate, because they haven't automated renewal, and don't need to over a mere $300. This lets for-profit CAs provide something Lets Encrypt doesn't offer. I don't get why they'd give up their one competitive benefit? Surely every customer of a paid CA is an organisation that hasn't automated certificate rotation?
      - crote 1y ago
        Short-term, it'll get rid of a bunch of competitors who are slower at setting up automated renewal infrastructure. Mid-term, it'll reduce the risk of noncompliance, as large customers can no longer demand that you delay revocation. CAs no longer have to fear customers switching to their competition. Long-term, it'll reduce their operating cost, as it is no longer necessary to handhold customers through the certification issuance and installation process. You just give them a URL, id, and key to enter a single time, and it should Just Work. The revenue loss of small customers can be compensated by regulatory capture and price hikes for EV. Tell the politicians that "everyone can get a basic cert these days", and that the really important stuff (like banking, hospitals, power grids) should be forced to buy EV certs.
        michaelt 1y ago
        > Long-term, it'll reduce their operating cost, It doesn't matter how far you reduce your operating cost, if your revenue falls to zero. > The revenue loss of small customers can be compensated by regulatory capture and price hikes for EV. Hah, that's a good one. Sure, google.com and microsoft.com and amazon.com and godaddy.com and letsencrypt.org and facebook.com and twitter.com and cloudflare.com and coinbase.com and and visa.com and entrust.com don't need EV certificates... but you do.
        ezconnect 1y ago
        Maybe that's the point of the big players making things harder for small business to operate independently. You want to put up shop online? Just use our services (eg Shopee, Temu, Amazon) to sell online and they get a cut on all your transaction. All the big players get a cut on every commerce on the internet. Want to put up a payment system not under their system? Their lobbies will take care of your startup before it even starts.
        nailer 1y ago
        > Tell the politicians that "everyone can get a basic cert these days", and that the really important stuff (like banking, hospitals, power grids) should be forced to buy EV certs. Google removed all the verification markers from chrome in September 2019 - because they investigated them and nobody understands a green box means verification. Yes, the obvious answer is: make the verification UI look like every other verification UI, but they didn’t did test that. The chrome team, specially ryan sleevi, thinks regular people should understand DNS. You know - apple.com.store/ipad isn’t Apple, and that withgoogle.com is actually Google.
- o_m 1y ago
  Shouldn't we be worried about the internet being centralized to depend on LetsEncrypt? Imagine the shit show if the US government stopped LetsEncrypt from issuing certificates to every country outside of the US.
  - toomuchtodo 1y ago
    How much would Lets Encrypt need to deploy an entirely separate legal and technical stack in Europe? Durable distributed foundational infrastructure is important.
  - matharmin 1y ago
    Luckily there are still other options out there. ZeroSSL is one I quite like: Free ACME-based certificates just like LetsEncrypt, without the rate limits, and does have paid plans if you need support. It also has better legacy client compatibility than LetsEncrypt as far as I know.
    - mattashii 1y ago
      I hope that ZeroSSL has improved their policies and procedures in the past years so they're more safe and robust. Four and a half years ago, there were some significant oversights in certificate lifecycle management, TOS, and handling of key material, which needed external parties to notify them of those issues before they fixed them. To me that was an indication of limited awareness of WebPKI and security principles. See e.g. https://bugzilla.mozilla.org/show_bug.cgi?id=1698936 https://bugzilla.mozilla.org/show_bug.cgi?id=1698936, https://bugzilla.mozilla.org/show_bug.cgi?id=1699756 https://bugzilla.mozilla.org/show_bug.cgi?id=1699756
  - michaelt 1y ago
    I'm kinda worried, personally. The CA/Browser Forum gets to set requirements for anyone who wants to run a website. If they decide website operators should renew their certificates monthly, website operators don't much choice in the matter. I worry that some day members of the forum will realise how much power that actually is. If there's a trade embargo on Country A, or a genocide going on in Country B, that perhaps 24-month certificates aren't the only sin they should use their power to correct.
- attentive 1y ago
  they now also compete with aws $15/year certs
- fpoling 1y ago
  The validity of any certificate by 2029 will be reduced to 47 days. The only way to compete with LetsEncrypt and other free providers would be on futures, like unlimited number of renewals and guaranteed reliability.
  - kedihacker 1y ago
    Support would be a big part of the enterprise and smaller ones pie but at 47 days everything would be integrating acme protocol so rough times ahead
- zenmac 1y ago
  And DTLS support. Last I checked, LetsEncrypt has issues with DTLS for webrtc. Don't know if it is still the case.
- hdgvhicv 1y ago
  I’ve been saying that for years, but HN loves single points of failure because half the people here fantasise about building the next SPOF they can extract rents from
bapak 1y ago
> "From a sysadmin and operations perspective: What a stupid change. In the perfect cloud native, fully automated fantasy land, this might work and not even generate that much overhead work. In the real world, this will generate lots of manual work. At least, until folks replace their legacy hardware and manufacturers patch their shit." Give me a break. This is your literal job description, something you should be able to do blind. If any random FE developer can put a proxy in front of their servers so can you.
- portaouflop 1y ago
  Wrong thread?
  - bapak 1y ago
    Have you read the article? I quoted the last paragraph.
    - TRiG_Ireland 1y ago
      I've read the article. You're in the wrong thread.
abujazar 1y ago
Kind of concerning they're not keeping TLS cert issuance even if only for the brand. Let's Encrypt is great, but it would be unfortunate if it ended up as a de facto monopoly.
bruce511 1y ago
I've been around long enough to remember when getting a website was really expensive. Like hundreds of thousands of $. TLS was expensive. And insanely profitable. The sale of Thwate to Verisign was north of 600 million. (Back when 600 million was "a lot"). Since the marginal cost of making a cert is zero it was a literal cash machine. LE broke that cash flow. CAs tried to claim their certificates were "safer" or the EV certs had any value at all. All nonsense, but for a while some layer of IT folk bought into that. Even today some of my clients believe that paid-for-certs are somehow different to free-certs. But that gravy train is rapidly ending. So yeah, once the fixed costs overwhelm the income expect to see more shutdowns. And naturally the small CAs will die first. I can't say I'll mourn any of them.
- dark-star 1y ago
  I have been helping individuals and small businesses set up websites since the 90s. At no point in time getting a website cost "hundreds of thousands of $" Hundreds? Sure. Thousands? maybe, if you wanted a rare/expensive domain name. But hundreds of thousands? No way
  - realo 1y ago
    whitehouse.com maybe?
  - bombcar 1y ago
    There was a whole bunch of execs convinced you couldn’t serve an HTML file without a massive Sun server
- V__ 1y ago
  But aren't there some differences? LE doesn't verify identitiy. Though I'm not saying that the big CEs are that thorough.
  - Kwpolska 1y ago
    Browsers stopped prominently showing the identities in EV certificates long ago. There is zero value in paying for a TLS certificate.
webprofusion 1y ago
For info, here is a list of some of the current ACME enabled CAs, not counting the purely commercial/enterprise gang: https://acmeclients.com/certificate-authorities/ https://acmeclients.com/certificate-authorities/
- webprofusion 1y ago
  For those looking to migrate, Let's Encrypt and Google Trust Services are my current favorite picks. ZeroSSL is ok but their ACME API status has been patchy recently and I'm a little worried about them.
jwr 1y ago
Happy to see this, to be honest. Selling SSL certificates was always a borderline scammy business — the companies provided barely any added value, their websites were terrible, buying certificates was always a pain, and one always had to fight through various upsells (usually with no value at all).
- skrause 1y ago
  Buypass was one of the free alternatives to Let's Encrypt that also supported the ACME protocol and even gave you 180 days validity.
  - ninjin 1y ago
    Indeed, I had just started using them at that. No account needed, you just needed to set your contact to "mailto:$EMAIL" and get on with your day. Was nice to use them for a few domains so as to make sure I had a more diverse set of tried and tested issuers, with bonus points to Buypass for being outside the US as well (Norway).
captn3m0 1y ago
Bought by Private Equity [TSS] <1y ago[0]. > Buypass AS has a new owner. Total Specific Solutions (TSS) took over ownership with effect from October 16, 2024. [0]: https://www.buypass.com/news/change-of-ownership-in-buypass-as https://www.buypass.com/news/change-of-ownership-in-buypass-...
bananapub 1y ago
it does seem like a good moment for some group outside the US to start issuing ACME certs.

48 points by gpi 1y ago

Beyond the big players like Digicert, I'm surprised smaller companies have survived LetsEncrypt for this long. They mentioned it in this post ad well, most are moving towards free providers. I wonder if we'll see more shutting down in the next few years. One thing I think they could compete on is validity period as LetsEncrypt keeps lowering theirs

bityard 1y ago
It's good that LetsEncrypt has eaten into the CA racket. Demanding money from people in exchange for a specific sequence of bits just to be able to host (even self-host) content securely on the web never should have been allowed in the first place.
Kwpolska 1y ago
Browsers also keep lowering the maximum validity period: https://www.theregister.com/2025/04/14/ssl_tls_certificates/ https://www.theregister.com/2025/04/14/ssl_tls_certificates/
- nickf 1y ago
  Not just browsers, CAs voted in favour too.
  - michaelt 1y ago
    To me, this seemed like turkeys voting for Christmas. Plenty of businesses with legacy systems will happily pay $300/year for a 1-year SSL certificate, because they haven't automated renewal, and don't need to over a mere $300. This lets for-profit CAs provide something Lets Encrypt doesn't offer. I don't get why they'd give up their one competitive benefit? Surely every customer of a paid CA is an organisation that hasn't automated certificate rotation?
    - crote 1y ago
      Short-term, it'll get rid of a bunch of competitors who are slower at setting up automated renewal infrastructure. Mid-term, it'll reduce the risk of noncompliance, as large customers can no longer demand that you delay revocation. CAs no longer have to fear customers switching to their competition. Long-term, it'll reduce their operating cost, as it is no longer necessary to handhold customers through the certification issuance and installation process. You just give them a URL, id, and key to enter a single time, and it should Just Work. The revenue loss of small customers can be compensated by regulatory capture and price hikes for EV. Tell the politicians that "everyone can get a basic cert these days", and that the really important stuff (like banking, hospitals, power grids) should be forced to buy EV certs.
      - michaelt 1y ago
        > Long-term, it'll reduce their operating cost, It doesn't matter how far you reduce your operating cost, if your revenue falls to zero. > The revenue loss of small customers can be compensated by regulatory capture and price hikes for EV. Hah, that's a good one. Sure, google.com and microsoft.com and amazon.com and godaddy.com and letsencrypt.org and facebook.com and twitter.com and cloudflare.com and coinbase.com and and visa.com and entrust.com don't need EV certificates... but you do.
        ezconnect 1y ago
        Maybe that's the point of the big players making things harder for small business to operate independently. You want to put up shop online? Just use our services (eg Shopee, Temu, Amazon) to sell online and they get a cut on all your transaction. All the big players get a cut on every commerce on the internet. Want to put up a payment system not under their system? Their lobbies will take care of your startup before it even starts.
      - nailer 1y ago
        > Tell the politicians that "everyone can get a basic cert these days", and that the really important stuff (like banking, hospitals, power grids) should be forced to buy EV certs. Google removed all the verification markers from chrome in September 2019 - because they investigated them and nobody understands a green box means verification. Yes, the obvious answer is: make the verification UI look like every other verification UI, but they didn’t did test that. The chrome team, specially ryan sleevi, thinks regular people should understand DNS. You know - apple.com.store/ipad isn’t Apple, and that withgoogle.com is actually Google.
o_m 1y ago
Shouldn't we be worried about the internet being centralized to depend on LetsEncrypt? Imagine the shit show if the US government stopped LetsEncrypt from issuing certificates to every country outside of the US.
- toomuchtodo 1y ago
  How much would Lets Encrypt need to deploy an entirely separate legal and technical stack in Europe? Durable distributed foundational infrastructure is important.
- matharmin 1y ago
  Luckily there are still other options out there. ZeroSSL is one I quite like: Free ACME-based certificates just like LetsEncrypt, without the rate limits, and does have paid plans if you need support. It also has better legacy client compatibility than LetsEncrypt as far as I know.
  - mattashii 1y ago
    I hope that ZeroSSL has improved their policies and procedures in the past years so they're more safe and robust. Four and a half years ago, there were some significant oversights in certificate lifecycle management, TOS, and handling of key material, which needed external parties to notify them of those issues before they fixed them. To me that was an indication of limited awareness of WebPKI and security principles. See e.g. https://bugzilla.mozilla.org/show_bug.cgi?id=1698936 https://bugzilla.mozilla.org/show_bug.cgi?id=1698936, https://bugzilla.mozilla.org/show_bug.cgi?id=1699756 https://bugzilla.mozilla.org/show_bug.cgi?id=1699756
- michaelt 1y ago
  I'm kinda worried, personally. The CA/Browser Forum gets to set requirements for anyone who wants to run a website. If they decide website operators should renew their certificates monthly, website operators don't much choice in the matter. I worry that some day members of the forum will realise how much power that actually is. If there's a trade embargo on Country A, or a genocide going on in Country B, that perhaps 24-month certificates aren't the only sin they should use their power to correct.
attentive 1y ago
they now also compete with aws $15/year certs
fpoling 1y ago
The validity of any certificate by 2029 will be reduced to 47 days. The only way to compete with LetsEncrypt and other free providers would be on futures, like unlimited number of renewals and guaranteed reliability.
- kedihacker 1y ago
  Support would be a big part of the enterprise and smaller ones pie but at 47 days everything would be integrating acme protocol so rough times ahead
zenmac 1y ago
And DTLS support. Last I checked, LetsEncrypt has issues with DTLS for webrtc. Don't know if it is still the case.
hdgvhicv 1y ago
I’ve been saying that for years, but HN loves single points of failure because half the people here fantasise about building the next SPOF they can extract rents from

bapak 1y ago

> "From a sysadmin and operations perspective: What a stupid change. In the perfect cloud native, fully automated fantasy land, this might work and not even generate that much overhead work. In the real world, this will generate lots of manual work. At least, until folks replace their legacy hardware and manufacturers patch their shit." Give me a break. This is your literal job description, something you should be able to do blind. If any random FE developer can put a proxy in front of their servers so can you.

portaouflop 1y ago
Wrong thread?
- bapak 1y ago
  Have you read the article? I quoted the last paragraph.
  - TRiG_Ireland 1y ago
    I've read the article. You're in the wrong thread.

abujazar 1y ago

Kind of concerning they're not keeping TLS cert issuance even if only for the brand. Let's Encrypt is great, but it would be unfortunate if it ended up as a de facto monopoly.

bruce511 1y ago

I've been around long enough to remember when getting a website was really expensive. Like hundreds of thousands of $. TLS was expensive. And insanely profitable. The sale of Thwate to Verisign was north of 600 million. (Back when 600 million was "a lot"). Since the marginal cost of making a cert is zero it was a literal cash machine. LE broke that cash flow. CAs tried to claim their certificates were "safer" or the EV certs had any value at all. All nonsense, but for a while some layer of IT folk bought into that. Even today some of my clients believe that paid-for-certs are somehow different to free-certs. But that gravy train is rapidly ending. So yeah, once the fixed costs overwhelm the income expect to see more shutdowns. And naturally the small CAs will die first. I can't say I'll mourn any of them.

dark-star 1y ago
I have been helping individuals and small businesses set up websites since the 90s. At no point in time getting a website cost "hundreds of thousands of $" Hundreds? Sure. Thousands? maybe, if you wanted a rare/expensive domain name. But hundreds of thousands? No way
- realo 1y ago
  whitehouse.com maybe?
- bombcar 1y ago
  There was a whole bunch of execs convinced you couldn’t serve an HTML file without a massive Sun server
V__ 1y ago
But aren't there some differences? LE doesn't verify identitiy. Though I'm not saying that the big CEs are that thorough.
- Kwpolska 1y ago
  Browsers stopped prominently showing the identities in EV certificates long ago. There is zero value in paying for a TLS certificate.

webprofusion 1y ago

For info, here is a list of some of the current ACME enabled CAs, not counting the purely commercial/enterprise gang: https://acmeclients.com/certificate-authorities/ https://acmeclients.com/certificate-authorities/

webprofusion 1y ago
For those looking to migrate, Let's Encrypt and Google Trust Services are my current favorite picks. ZeroSSL is ok but their ACME API status has been patchy recently and I'm a little worried about them.

jwr 1y ago

Happy to see this, to be honest. Selling SSL certificates was always a borderline scammy business — the companies provided barely any added value, their websites were terrible, buying certificates was always a pain, and one always had to fight through various upsells (usually with no value at all).

skrause 1y ago
Buypass was one of the free alternatives to Let's Encrypt that also supported the ACME protocol and even gave you 180 days validity.
- ninjin 1y ago
  Indeed, I had just started using them at that. No account needed, you just needed to set your contact to "mailto:$EMAIL" and get on with your day. Was nice to use them for a few domains so as to make sure I had a more diverse set of tried and tested issuers, with bonus points to Buypass for being outside the US as well (Norway).

captn3m0 1y ago

Bought by Private Equity [TSS] <1y ago[0]. > Buypass AS has a new owner. Total Specific Solutions (TSS) took over ownership with effect from October 16, 2024. [0]: https://www.buypass.com/news/change-of-ownership-in-buypass-as https://www.buypass.com/news/change-of-ownership-in-buypass-...

bananapub 1y ago

it does seem like a good moment for some group outside the US to start issuing ACME certs.