It really is a license to print money. That's not an attack though, most SaaS businesses are. What's unique about being a SSL issuer is the relatively low lev

It really is a license to print money. That's not an attack though, most SaaS businesses are. What's unique about being a SSL issuer is the relatively low levels of innovation involved. There is little technical innovation, and no time spent thinking about how to design a product that people want. Putting all the pieces together and striking the right deals certainly requires a bit of business savvy, especially to have done it in 1997, but otherwise the business is rather straight-forward. I think part of the hostility towards SSL issuers comes from the seemingly monopolistic pricing structure. As you note, validation is the largest expense. Largely, that only needs to be done once though, so why doesn't the cost drop dramatically in the second year? And it seems clear to most people that the cost of servicing a domain and its subdomains should not be an order of magnitude higher. If a SSL issuer charged me an upfront service fee representing the cost of validation, then low yearly maintenance fees, and didn't gouge me for subdomains or multiple domains with clearly the same ownership (.com .net), they would have my business forever and my gratitude.