3 ms·
They charge for things that impose costs on them: hosting revocation info and higher levels of identity verification.
by dmm 12y ago
They charge for things that impose costs on them: hosting revocation info and higher levels of identity verification.
- Karunamon 12y agoThe CRL file(s) could be hosted on any CDN worth their salt for less than the price of 4 people regenerating certs. SNI is also an option for newer clients. It's pure profit/rent seeking. That same $25 applies regardless of the reason. OpenSSL compromised? Fuck you, pay me. Miskeyed the CN? Fuck you, pay me. Want a different type of cert for the same domain? (XMPP instead of web?) Fuck you, pay me. You get the idea. It doesn't cost $25 for a few byte fingerprint to be automatically appended to the end of a file. In some of these cases they don't even need to revoke the other cert, just delete the erroneously created one from their system because it was never used anyways! Never mind the fact that their UI would have been an embarrassment a decade ago, and they absolutely require certificate-based login to get into the UI, which is a huge PITA.
- iancarroll 12y ago> The CRL file(s) could be hosted on any CDN worth their salt for less than the price of 4 people regenerating certs. SNI is also an option for newer clients. Have you seen the article with Cloudflare and Globalsign's CRL?