Timeline for Why are SSL certificates an annual expense?
Current License: CC BY-SA 3.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 12, 2017 at 22:04 | comment | added | dave k | @slebetman: You're right, servers are not the only cost, they are one of many cost. The reason letsencrypt is able to do it 'for free' is because they have sponsors and people that donate to their nonprofit organization. They are also able to keep cost down by employing only a small team and not having much if any Customer Service to handle support calls. Also, it seemed like you equated creating the validation of trust is a cost, but that would be interesting consider LetsEncrypt expires in a relatively short time frame of 90 days, and actually recommend replacement every 60 days. | |
| Apr 12, 2017 at 14:55 | comment | added | user | @AndrewSavinykh There are approximately 526,000 minutes in a year. A 0.01% downtime (whatever that means) means that certificate validation will have serious problems about 5,260 minutes per year. With HSTS becoming more and more popular, this translates directly to the customers of your (the CA's) customers being unable to reach your (the CA's) customer's web site for almost 88 hours per year. Suppose Amazon's web site was unreachable for several days per year. Suppose that happens during high traffic periods. What would that do to Amazon's bottom line? | |
| Apr 12, 2017 at 14:21 | comment | added | Dan Is Fiddling By Firelight | @AndrewSavinykh $5 hosting is getting you a tiny slice of a single web server in one location, and can handle only a small amount of traffic. CA's need to have large numbers of servers located around the world so that they're always close to the end users verifying their certs to minimize network transit latency. They also need to be able to handle huge amounts of traffic (they get pinged every time a page with a cert they sold is used) while maintaining peak server loads low enough that there's never a delay in the servers response. CA infrastructure is closer to google than $5 hosting. | |
| Apr 12, 2017 at 11:53 | history | edited | Mike Ounsworth | CC BY-SA 3.0 |
added 711 characters in body; added 34 characters in body; added 8 characters in body
|
| Apr 12, 2017 at 8:18 | comment | added | IMSoP | @PlasmaHH If there was no other reason for short certificates than making money, free CAs like Let's Encrypt would issue 10-year certificates, because it would be cheaper for them to operate the service. They don't, because the certificate expiry is there for security reasons not just as a money-making exercise. | |
| Apr 12, 2017 at 7:38 | comment | added | PlasmaHH | @IMSoP: Why is these days all kinds of software a monthly fee instead of a one time thing? Simply because they can do it, because people pay it. Same for certificates. They can do it because people pay for it. If people would not be willing to pay more than $5 for a 10 year certificate, then that would be what the market settles to. But people are willing to pay for a short lived certificate so that is what the market has settled to. | |
| Apr 12, 2017 at 6:53 | comment | added | Andrew Savinykh | @davek what servers? on Digital Ocean you can run a web server for 5$ a month with 99.99% SLA. It does not feel like cost of running servers would be a major cost in such a setup. Until you can give some evidence that server maintanence constitutes substential part of the costs of running the entire business, the argument is unconvincing. | |
| Apr 12, 2017 at 2:19 | comment | added | anon | "Disclosure..." That's not a disclosure, that's a source. | |
| Apr 12, 2017 at 1:39 | comment | added | slebetman | @davek: That's not what IMSoP is saying. The reason why it's a recurring process is not due to recurring cost of running the servers (indeed, letsencrypt charge you $0 for a certificate yet they must still maintain their servers). The reason why it is a recurring process is because validating trust (which is the model certificates are based on) must be done periodically therefore by design certificates must expire and be re-issued. It's a security decision based on the security model the whole system was designed around | |
| Apr 11, 2017 at 20:15 | comment | added | jpmc26 | "sure, 99% of consumers won't notice" On the flip side, if your users are adversely affected on any kind of scale, people would certainly notice. Sometimes you pay to avoid becoming headline news. ;) | |
| Apr 11, 2017 at 20:08 | comment | added | dave k | Mike stated that they have to maintain servers at a high level of uptime. This cost money. As a result, they need reoccurring income to cover the expense. I assume they could handle that as a one time cost to cover the 50 years you mentioned, but that would escalate the cost, dramatically. | |
| Apr 11, 2017 at 17:19 | comment | added | IMSoP | This explains why CAs charge money, but not really why that money is a recurring fee. It's a recurring fee because it's a recurring process, and it's a recurring process for security reasons, not financial ones. Everything you say in this answer would apply to a certificate with an expiry date 50 years in the future, or with no expiry date at all, if clients would honour such a thing. | |
| Apr 11, 2017 at 15:35 | history | answered | Mike Ounsworth | CC BY-SA 3.0 |