5 ms·

Beyond the big players like Digicert, I'm surprised smaller companies have survived LetsEncrypt for this long. They mentioned it in this post ad well, most are

Beyond the big players like Digicert, I'm surprised smaller companies have survived LetsEncrypt for this long. They mentioned it in this post ad well, most are moving towards free providers. I wonder if we'll see more shutting down in the next few years. One thing I think they could compete on is validity period as LetsEncrypt keeps lowering theirs

bityard 1y ago
It's good that LetsEncrypt has eaten into the CA racket. Demanding money from people in exchange for a specific sequence of bits just to be able to host (even self-host) content securely on the web never should have been allowed in the first place.
Kwpolska 1y ago
Browsers also keep lowering the maximum validity period: https://www.theregister.com/2025/04/14/ssl_tls_certificates/ https://www.theregister.com/2025/04/14/ssl_tls_certificates/
- nickf 1y ago
  Not just browsers, CAs voted in favour too.
  - michaelt 1y ago
    To me, this seemed like turkeys voting for Christmas. Plenty of businesses with legacy systems will happily pay $300/year for a 1-year SSL certificate, because they haven't automated renewal, and don't need to over a mere $300. This lets for-profit CAs provide something Lets Encrypt doesn't offer. I don't get why they'd give up their one competitive benefit? Surely every customer of a paid CA is an organisation that hasn't automated certificate rotation?
    - crote 1y ago
      Short-term, it'll get rid of a bunch of competitors who are slower at setting up automated renewal infrastructure. Mid-term, it'll reduce the risk of noncompliance, as large customers can no longer demand that you delay revocation. CAs no longer have to fear customers switching to their competition. Long-term, it'll reduce their operating cost, as it is no longer necessary to handhold customers through the certification issuance and installation process. You just give them a URL, id, and key to enter a single time, and it should Just Work. The revenue loss of small customers can be compensated by regulatory capture and price hikes for EV. Tell the politicians that "everyone can get a basic cert these days", and that the really important stuff (like banking, hospitals, power grids) should be forced to buy EV certs.
      - michaelt 1y ago
        > Long-term, it'll reduce their operating cost, It doesn't matter how far you reduce your operating cost, if your revenue falls to zero. > The revenue loss of small customers can be compensated by regulatory capture and price hikes for EV. Hah, that's a good one. Sure, google.com and microsoft.com and amazon.com and godaddy.com and letsencrypt.org and facebook.com and twitter.com and cloudflare.com and coinbase.com and and visa.com and entrust.com don't need EV certificates... but you do.
        ezconnect 1y ago
        Maybe that's the point of the big players making things harder for small business to operate independently. You want to put up shop online? Just use our services (eg Shopee, Temu, Amazon) to sell online and they get a cut on all your transaction. All the big players get a cut on every commerce on the internet. Want to put up a payment system not under their system? Their lobbies will take care of your startup before it even starts.
      - nailer 1y ago
        > Tell the politicians that "everyone can get a basic cert these days", and that the really important stuff (like banking, hospitals, power grids) should be forced to buy EV certs. Google removed all the verification markers from chrome in September 2019 - because they investigated them and nobody understands a green box means verification. Yes, the obvious answer is: make the verification UI look like every other verification UI, but they didn’t did test that. The chrome team, specially ryan sleevi, thinks regular people should understand DNS. You know - apple.com.store/ipad isn’t Apple, and that withgoogle.com is actually Google.
o_m 1y ago
Shouldn't we be worried about the internet being centralized to depend on LetsEncrypt? Imagine the shit show if the US government stopped LetsEncrypt from issuing certificates to every country outside of the US.
- toomuchtodo 1y ago
  How much would Lets Encrypt need to deploy an entirely separate legal and technical stack in Europe? Durable distributed foundational infrastructure is important.
- matharmin 1y ago
  Luckily there are still other options out there. ZeroSSL is one I quite like: Free ACME-based certificates just like LetsEncrypt, without the rate limits, and does have paid plans if you need support. It also has better legacy client compatibility than LetsEncrypt as far as I know.
  - mattashii 1y ago
    I hope that ZeroSSL has improved their policies and procedures in the past years so they're more safe and robust. Four and a half years ago, there were some significant oversights in certificate lifecycle management, TOS, and handling of key material, which needed external parties to notify them of those issues before they fixed them. To me that was an indication of limited awareness of WebPKI and security principles. See e.g. https://bugzilla.mozilla.org/show_bug.cgi?id=1698936 https://bugzilla.mozilla.org/show_bug.cgi?id=1698936, https://bugzilla.mozilla.org/show_bug.cgi?id=1699756 https://bugzilla.mozilla.org/show_bug.cgi?id=1699756
- michaelt 1y ago
  I'm kinda worried, personally. The CA/Browser Forum gets to set requirements for anyone who wants to run a website. If they decide website operators should renew their certificates monthly, website operators don't much choice in the matter. I worry that some day members of the forum will realise how much power that actually is. If there's a trade embargo on Country A, or a genocide going on in Country B, that perhaps 24-month certificates aren't the only sin they should use their power to correct.
attentive 1y ago
they now also compete with aws $15/year certs
fpoling 1y ago
The validity of any certificate by 2029 will be reduced to 47 days. The only way to compete with LetsEncrypt and other free providers would be on futures, like unlimited number of renewals and guaranteed reliability.
- kedihacker 1y ago
  Support would be a big part of the enterprise and smaller ones pie but at 47 days everything would be integrating acme protocol so rough times ahead
zenmac 1y ago
And DTLS support. Last I checked, LetsEncrypt has issues with DTLS for webrtc. Don't know if it is still the case.
hdgvhicv 1y ago
I’ve been saying that for years, but HN loves single points of failure because half the people here fantasise about building the next SPOF they can extract rents from

bityard 1y ago

It's good that LetsEncrypt has eaten into the CA racket. Demanding money from people in exchange for a specific sequence of bits just to be able to host (even self-host) content securely on the web never should have been allowed in the first place.

Kwpolska 1y ago

Browsers also keep lowering the maximum validity period: https://www.theregister.com/2025/04/14/ssl_tls_certificates/ https://www.theregister.com/2025/04/14/ssl_tls_certificates/

nickf 1y ago
Not just browsers, CAs voted in favour too.
- michaelt 1y ago
  To me, this seemed like turkeys voting for Christmas. Plenty of businesses with legacy systems will happily pay $300/year for a 1-year SSL certificate, because they haven't automated renewal, and don't need to over a mere $300. This lets for-profit CAs provide something Lets Encrypt doesn't offer. I don't get why they'd give up their one competitive benefit? Surely every customer of a paid CA is an organisation that hasn't automated certificate rotation?
  - crote 1y ago
    Short-term, it'll get rid of a bunch of competitors who are slower at setting up automated renewal infrastructure. Mid-term, it'll reduce the risk of noncompliance, as large customers can no longer demand that you delay revocation. CAs no longer have to fear customers switching to their competition. Long-term, it'll reduce their operating cost, as it is no longer necessary to handhold customers through the certification issuance and installation process. You just give them a URL, id, and key to enter a single time, and it should Just Work. The revenue loss of small customers can be compensated by regulatory capture and price hikes for EV. Tell the politicians that "everyone can get a basic cert these days", and that the really important stuff (like banking, hospitals, power grids) should be forced to buy EV certs.
    - michaelt 1y ago
      > Long-term, it'll reduce their operating cost, It doesn't matter how far you reduce your operating cost, if your revenue falls to zero. > The revenue loss of small customers can be compensated by regulatory capture and price hikes for EV. Hah, that's a good one. Sure, google.com and microsoft.com and amazon.com and godaddy.com and letsencrypt.org and facebook.com and twitter.com and cloudflare.com and coinbase.com and and visa.com and entrust.com don't need EV certificates... but you do.
      - ezconnect 1y ago
        Maybe that's the point of the big players making things harder for small business to operate independently. You want to put up shop online? Just use our services (eg Shopee, Temu, Amazon) to sell online and they get a cut on all your transaction. All the big players get a cut on every commerce on the internet. Want to put up a payment system not under their system? Their lobbies will take care of your startup before it even starts.
    - nailer 1y ago
      > Tell the politicians that "everyone can get a basic cert these days", and that the really important stuff (like banking, hospitals, power grids) should be forced to buy EV certs. Google removed all the verification markers from chrome in September 2019 - because they investigated them and nobody understands a green box means verification. Yes, the obvious answer is: make the verification UI look like every other verification UI, but they didn’t did test that. The chrome team, specially ryan sleevi, thinks regular people should understand DNS. You know - apple.com.store/ipad isn’t Apple, and that withgoogle.com is actually Google.

o_m 1y ago

Shouldn't we be worried about the internet being centralized to depend on LetsEncrypt? Imagine the shit show if the US government stopped LetsEncrypt from issuing certificates to every country outside of the US.

toomuchtodo 1y ago
How much would Lets Encrypt need to deploy an entirely separate legal and technical stack in Europe? Durable distributed foundational infrastructure is important.
matharmin 1y ago
Luckily there are still other options out there. ZeroSSL is one I quite like: Free ACME-based certificates just like LetsEncrypt, without the rate limits, and does have paid plans if you need support. It also has better legacy client compatibility than LetsEncrypt as far as I know.
- mattashii 1y ago
  I hope that ZeroSSL has improved their policies and procedures in the past years so they're more safe and robust. Four and a half years ago, there were some significant oversights in certificate lifecycle management, TOS, and handling of key material, which needed external parties to notify them of those issues before they fixed them. To me that was an indication of limited awareness of WebPKI and security principles. See e.g. https://bugzilla.mozilla.org/show_bug.cgi?id=1698936 https://bugzilla.mozilla.org/show_bug.cgi?id=1698936, https://bugzilla.mozilla.org/show_bug.cgi?id=1699756 https://bugzilla.mozilla.org/show_bug.cgi?id=1699756
michaelt 1y ago
I'm kinda worried, personally. The CA/Browser Forum gets to set requirements for anyone who wants to run a website. If they decide website operators should renew their certificates monthly, website operators don't much choice in the matter. I worry that some day members of the forum will realise how much power that actually is. If there's a trade embargo on Country A, or a genocide going on in Country B, that perhaps 24-month certificates aren't the only sin they should use their power to correct.

attentive 1y ago

they now also compete with aws $15/year certs

fpoling 1y ago

The validity of any certificate by 2029 will be reduced to 47 days. The only way to compete with LetsEncrypt and other free providers would be on futures, like unlimited number of renewals and guaranteed reliability.

kedihacker 1y ago
Support would be a big part of the enterprise and smaller ones pie but at 47 days everything would be integrating acme protocol so rough times ahead

zenmac 1y ago

And DTLS support. Last I checked, LetsEncrypt has issues with DTLS for webrtc. Don't know if it is still the case.

hdgvhicv 1y ago

I’ve been saying that for years, but HN loves single points of failure because half the people here fantasise about building the next SPOF they can extract rents from