News for hackers. Stuff that matters.

A comment on Final Removal of Trust in WoSign and StartCom Certificates. Parent comment

Re:Final Removal of Trust in WoSign and StartCom Certificates by Kadin on Friday July 07, 2017 @07:32PM (#14723058)
> Issuing certificates cost money and has to be paid one way or another.

It's not clear that the prices being charged by commercial CAs are anywhere close or even related to the underlying costs.

I think LE is beginning to demonstrate that the costs of operating a CA are not actually that high, at the same time that the lax behavior by certain commercial CAs has demonstrated that the "validation" they provide is of very little value.

[ Parent | on HN ]
Re:Final Removal of Trust in WoSign and StartCom Certificates by Karunamon on Friday July 07, 2017 @09:37PM (#14723556)
Most of the cost tied up in being a CA is being audited and reaudited by a third party that charges hundreds of thousands of dollars (and given the Symantec/Startcom shenanigans, is completely worthless).

The actual technical infrastructure required, while intricate, isn't that hard to set up.

[ Parent | on HN ]