3 ms·

Ehm, excuse me but gimme a break. Owning a CA is a license to print money - it's as simple as that and really no need for excuses. The costs you cite are dwar

by moe 18y ago

Ehm, excuse me but gimme a break. Owning a CA is a license to print money - it's as simple as that and really no need for excuses. The costs you cite are dwarfed by the profits. Vetting/validation and support is a fixed cost (support squad), legal costs can't be too rough (how often is that warranty actually claimed?) and well, cry me a river about the chain of extortion going up the CA chain. Yeah, it's really annoying you can't build your own money-printer, you have to rent it! Honestly, a tiny bit of math sobers me of any pity: 1 million customers, $100 bucks a year. That's a solid one hundred million bucks annually. That kind of money buys quite a bit of vetting/validation and legal costs. It might even cover your 30T/month crl-traffic. Barely.

nickf 18y ago
I'm not making any excuses. It's just that there's been a lot of discussion about SSL certs the past few months, and I'm willing to bet there's no more than a roomful of people worldwide with the knowledge and experience to understand how to run a CA and the costs associated. Does your anger extend towards the domain name companies? Webhosts? After all, running on free software and 'cheap' commodity hardware - Dreamhost probably make the same figures you're talking about, and they don't have a lot of the large up-front an annual costs. Just an example, really. To address each point: Validation - not a fixed cost. Some can take several real man-hours to complete, and additional costs of access to third-party databases, translation costs. I see it possible to make a loss on some certs purely in validation. Legal costs - insurance premiums for something this specialised are high, regardless of how many claims made. CA chaining - as per other comments, you're lookat at potentially $50K a year just in audit costs, just to get into the mainstream browsers, with a 5-10 year wait to become ubiquitous enough to be commerically viable. You can pay to get a sub-CA and bypass this step, but it will cost...you can go into 7 figures annually. Again, I'm not attempting to make excuses. I do agree some certificates are overpriced. I am just trying to show how the CA industry is no more a 'racket' or 'license to print money' than many more of the internet-centric businesses that exist, even though it may seem that way without insight. Plus, it keeps me gainfully employed :)
- tc 18y ago
  It really is a license to print money. That's not an attack though, most SaaS businesses are. What's unique about being a SSL issuer is the relatively low levels of innovation involved. There is little technical innovation, and no time spent thinking about how to design a product that people want. Putting all the pieces together and striking the right deals certainly requires a bit of business savvy, especially to have done it in 1997, but otherwise the business is rather straight-forward. I think part of the hostility towards SSL issuers comes from the seemingly monopolistic pricing structure. As you note, validation is the largest expense. Largely, that only needs to be done once though, so why doesn't the cost drop dramatically in the second year? And it seems clear to most people that the cost of servicing a domain and its subdomains should not be an order of magnitude higher. If a SSL issuer charged me an upfront service fee representing the cost of validation, then low yearly maintenance fees, and didn't gouge me for subdomains or multiple domains with clearly the same ownership (.com .net), they would have my business forever and my gratitude.
- jackowayed 18y ago
  The anger is because domains cost $10 and SSL Certificates cost $1000. And you're telling me that companies that have to buy servers (which break, go obsolete, and require power in the meantime), racks, cooling, warehouse space, backup power, and fast and redundant Internet connections, and setup a good way for people to manage their hosting (not to mention support!) "don't have a lot of the large up-front an[d] annual costs"?
  - nickf 18y ago
    They did cost thousands, but the monopoly is no longer and you can get certs for $10 if you hunt. EV ones can cost up to $1000 again, but they genuniely do cost more to issue. And no, I'm not saying they don't have large costs. You can become a webhost with a couple of co-lo boxes for relatively little cost. You can't do that with a CA.
    - leej 18y ago
      @moe we all understand what you're saying but nickf has nothing to do with this thing. your logic applies better to lots of other companies but here is hacker news so please.. @nickf i will buy an SSL certificate i need your advice. my needs are it should not ask any security alert dialog boxes and supports FF, Safari, Opera and IE. that's all. does those 20$ range ones work for me or what is your suggestion? one more question how does insurance work? Merchant accounst also have insurance. Are these same? Please explain this too.

by moe 18y ago

nickf 18y ago

I'm not making any excuses. It's just that there's been a lot of discussion about SSL certs the past few months, and I'm willing to bet there's no more than a roomful of people worldwide with the knowledge and experience to understand how to run a CA and the costs associated. Does your anger extend towards the domain name companies? Webhosts? After all, running on free software and 'cheap' commodity hardware - Dreamhost probably make the same figures you're talking about, and they don't have a lot of the large up-front an annual costs. Just an example, really. To address each point: Validation - not a fixed cost. Some can take several real man-hours to complete, and additional costs of access to third-party databases, translation costs. I see it possible to make a loss on some certs purely in validation. Legal costs - insurance premiums for something this specialised are high, regardless of how many claims made. CA chaining - as per other comments, you're lookat at potentially $50K a year just in audit costs, just to get into the mainstream browsers, with a 5-10 year wait to become ubiquitous enough to be commerically viable. You can pay to get a sub-CA and bypass this step, but it will cost...you can go into 7 figures annually. Again, I'm not attempting to make excuses. I do agree some certificates are overpriced. I am just trying to show how the CA industry is no more a 'racket' or 'license to print money' than many more of the internet-centric businesses that exist, even though it may seem that way without insight. Plus, it keeps me gainfully employed :)

tc 18y ago
It really is a license to print money. That's not an attack though, most SaaS businesses are. What's unique about being a SSL issuer is the relatively low levels of innovation involved. There is little technical innovation, and no time spent thinking about how to design a product that people want. Putting all the pieces together and striking the right deals certainly requires a bit of business savvy, especially to have done it in 1997, but otherwise the business is rather straight-forward. I think part of the hostility towards SSL issuers comes from the seemingly monopolistic pricing structure. As you note, validation is the largest expense. Largely, that only needs to be done once though, so why doesn't the cost drop dramatically in the second year? And it seems clear to most people that the cost of servicing a domain and its subdomains should not be an order of magnitude higher. If a SSL issuer charged me an upfront service fee representing the cost of validation, then low yearly maintenance fees, and didn't gouge me for subdomains or multiple domains with clearly the same ownership (.com .net), they would have my business forever and my gratitude.
jackowayed 18y ago
The anger is because domains cost $10 and SSL Certificates cost $1000. And you're telling me that companies that have to buy servers (which break, go obsolete, and require power in the meantime), racks, cooling, warehouse space, backup power, and fast and redundant Internet connections, and setup a good way for people to manage their hosting (not to mention support!) "don't have a lot of the large up-front an[d] annual costs"?
- nickf 18y ago
  They did cost thousands, but the monopoly is no longer and you can get certs for $10 if you hunt. EV ones can cost up to $1000 again, but they genuniely do cost more to issue. And no, I'm not saying they don't have large costs. You can become a webhost with a couple of co-lo boxes for relatively little cost. You can't do that with a CA.
  - leej 18y ago
    @moe we all understand what you're saying but nickf has nothing to do with this thing. your logic applies better to lots of other companies but here is hacker news so please.. @nickf i will buy an SSL certificate i need your advice. my needs are it should not ask any security alert dialog boxes and supports FF, Safari, Opera and IE. that's all. does those 20$ range ones work for me or what is your suggestion? one more question how does insurance work? Merchant accounst also have insurance. Are these same? Please explain this too.