News for hackers. Stuff that matters.
Re:Symantec Issues Intermediate CA Certificate for Blue Coat... by tajen on Friday May 27, 2016 @05:51AM (#11784926)
How did we allow a single company to own 30% of a market, despite its expensive pricing (https://www.symantec.com/en/uk/theme.jsp?themeid=compare-ssl...)?

Comodo and Synantec are 32% each, then goes others. StartSSl is significant but 2%, Let'sEncrypt tiny for now: https://w3techs.com/technologies/history_overview/ssl_certif...

Re:Symantec Issues Intermediate CA Certificate for Blue Coat... by Morpholemew on Friday May 27, 2016 @09:30AM (#11785859)
I'm not able to find the methodology for the w3techs report, but I suspect they only count the ultimate root, not any intermediates.

Let's Encrypt's root is not trusted by any browser yet, so they got a cross-signature from IdenTrust. So far, basically everybody using Let's Encrypt chains to the IdenTrust root.

Given that IdenTrust grew from "<0.1%" to 5.6% since the launch of Let's Encrypt, and the shape is roughly the same as https://letsencrypt.org/stats/ , I strongly suspect that the 5.6% market share credited to IdenTrust actually belongs to Let's Encrypt.

As a check, we can divide 2/3 of the total unexpired Let's Encrypt certificates (~2.8M as of last week, 2/3 because standard practise is to renew a 90 day cert after 60 days, so 1/3 are probably overlapping = 1.86M) by the total number of https sites (I had a hard time finding this, but http://arstechnica.com/security/2016/03/more-than-13-million... claims that 5.9M is 17% of https servers, so 34.7M), and we get 5.4%, which is almost the same number as the IdenTrust number above.

That's still nowhere near Comodo, but it's not completely insignificant.

Re:Symantec Issues Intermediate CA Certificate for Blue Coat... by jaas on Friday May 27, 2016 @11:20AM (#11786555)
"Given that IdenTrust grew from "<0.1%" to 5.6% since the launch of Let's Encrypt, and the shape is roughly the same as https://letsencrypt.org/stats/ , I strongly suspect that the 5.6% market share credited to IdenTrust actually belongs to Let's Encrypt."

This is correct. (Source: I run Let's Encrypt)