3 ms·
Can somebody explain to me 1) why SSL certificats are so expensive 2) Why do they have to expire?
by igouss 12y ago
Can somebody explain to me 1) why SSL certificats are so expensive 2) Why do they have to expire?
- spydum 12y ago1) theoretically, it's essentially the background check the CA's perform to ensure you are you 2) to ensure you still are you, and to setup a nice recurring revenue stream for the CA's :) (err it probably has something to do with security)
- mike_hearn 12y ago1) They are not, really. You can get free DV certs from StartSSL. Other types of certs do cost money because issuing them involves real work. I don't know how else to explain it. Go look at the list of things a CA has to do to be considered trustable by the major root store operators (operating system vendors, browser makers). It's not trivial. 2) The original reason was because it was assumed (correctly) that due to hardware improvements keys that were previously strong would become weak. So it was supposed to encode a length of time after which the cert owner would be forced to re-evaluate key strength. Nowadays the browser makers are tending to lean on CAs to push expiry times downwards so they expire quicker, the reason being that updating the SSL ecosystem often requires new features or changes in certificates, and if certs can last 5 years then it means a full upgrade takes 5 years, whereas if certs expire after one year then one year after deployment begins everyone is updated. Pretty big difference. It's for this reason that EV certs are specced to expire after a year: it means standards can be revved quicker.