Timeline for Why are SSL certificates an annual expense?
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 16, 2020 at 9:49 | history | edited | CommunityBot |
Commonmark migration
|
|
| Apr 13, 2017 at 10:48 | comment | added | Tom | A 10-years certificate cost them more than a 1-year certificate, because they have to maintain revocation and trust during 10 years instead of 1. And some CA sells insurance linked to the certificate, so, more expensive too. A 2-years certificate cost them more than a 1-year certificate. Not 2 times more, but more. | |
| Apr 13, 2017 at 10:42 | comment | added | IMSoP | OK, I think I get what you're saying now: the CA has to set some lifetime, because they have to account for running costs over that lifetime. They could issue a 10-year certificate for 10 times the price of a 1-year certificate (if there were no security reasons not to do so), but they wouldn't know what to charge for an open-ended certificate, because they would have no idea how many years they'd have to maintain it for. (Although note that some of the costs in your edit would be lower for longer or unlimited lifetimes, e.g. validation happens more often the shorter the lifetime.) | |
| Apr 13, 2017 at 10:30 | comment | added | Tom | @IMSoP I've add information about OCSP and Let's Encrypt costs | |
| Apr 13, 2017 at 10:29 | history | edited | Tom | CC BY-SA 3.0 |
added 402 characters in body
|
| Apr 13, 2017 at 8:52 | history | edited | Tom | CC BY-SA 3.0 |
added 347 characters in body
|
| Apr 12, 2017 at 15:35 | comment | added | IMSoP | @MichaelKjörling Why would there be 10 times as many requests for revocation data? If you have 100 customers with 10-year certificates, that's 100*n requests; if you have 100 customers with 1-year certificates that they renew every year for 10 years, that's still 100*n requests. At any given moment, the volume of revocation requests is proportional to the number of currently valid certificates, regardless of how long those certificates are valid for. The only extra certificates would be customers who are "locked in" by the longer expiry, who would otherwise not have renewed. | |
| Apr 12, 2017 at 15:03 | comment | added | user | @IMSoP CAs only need to supply revocation information for currently-valid certificates; expired certificates are expected to be untrusted by default. However, they do need to supply revocation information for currently-valid certs. So if a CA issues a single certificate for one year or ten years they need to supply revocation data for that period of time. If a CA issues certificates valid for ten years, then by consequence it needs to serve ten times as much revocation data, and handle ten times as many requests for revocation data, than if it issued certificates valid only for one year. | |
| Apr 12, 2017 at 14:32 | comment | added | IMSoP | Thinking about it, I don't think this adds up. The cost to respond to OCSP queries is proportional only to the number of currently non-expired certificates. If you are the issuer for a domain for 10 years, you will hold 1 record at a time for that domain, whether that's a single 10-year record, or 10 consecutive 1-year records, or 120 consecutive 1-month records. The only marginal costs I can see are a slightly longer revocation list (containing revocations from longer ago), and maintaining records for customers who would have let renewal lapse; neither seems likely to be that high. | |
| Apr 11, 2017 at 15:28 | history | answered | Tom | CC BY-SA 3.0 |