4 ms·
Running a commercial CA is not for amateurs or those with a weak stomach. It's a LOT of work, and costs a LOT of money. The operational security requirements
by pharaohgeek 13y ago
Running a commercial CA is not for amateurs or those with a weak stomach. It's a LOT of work, and costs a LOT of money. The operational security requirements are VERY high in order gain the trust of your customers. The physical security alone is prohibitively expensive for most companies. Man traps, secure server rooms (REALLY secure), biometrics, etc. Additionally, there are the technical security requirements. Smartcards, hardware security modules (HSMs) for key storage, and so on.
In order to gain the trust of the browser manufacturers, your PKI has to be certified by a recognized standards body. This is not easy, and it is not cheap. Every aspect of your operation and infrastructure needs to be documented, and you have to stick to it. No relaxing on the rules.
Practically speaking, you're talking about an expense on the order of a 7-figure expense to get things up and running, with additional costs for certification, etc.
SOURCE: I've worked on the largest PKI in the world (Fed. Gov't) as well as the largest commercial CAs for the last 14 years.
- CyberFonic 13y agoThanks for the terrific insight. Had no idea that it was like running Fort Knox. With that sort of investment, no wonder the pressure to amortise capital costs pushes the prices up.
- pharaohgeek 13y agoWell, you also have to remember that the marginal costs of issuing a cert are next to nothing. Once you've spent your money getting everything built out and certified, issuing a single certificate is almost pure profit! That's especially true for run-of-the-mill SSL certificates. Obviously, if you're an enterprise and you want a full, hosted PKI solution there are additional costs and work involved. But, for the commercial certs you buy one at a time from Verisign, et al, the marginal cost is very low.