http://www.startssl.com/ will give you a free class one SSL cert that works in all major browsers. They will also sell you a class 2 cert with wildcard support for $49 a year. These can cost $800+ in other places IIRC.
They are trying valiantly to destroy the entrenched price structure of the SSL cert market and I wish them the best of luck.
E.g. it works with Internet Explorer. Does that include IE6? They don't say.
But yes, as far as I remember, they do work on IE6. The root certs dont really change between browser versions I think, its more a matter of the the different vendors.
DNS is not used for key storage as DNS is not authenticated. There is nothing stopping your registrar from being a CA and issuing you certificates.
SSL certs are assigned to specific domain names. The CA really doesn't need to care if you are a Fooian Industries registered as a Romanian company. They are only interested in if you are the proper owner of fooian-ind.com. That your local government official knows that you are fierarul is of no value in determining if the cert someone sent me for fooian-ind.com is the correct one for fooian-ind.com.
The infrastructure to support SSL is the result of a large number of smart people sitting down together and working out solutions. Chances are that any deficiencies or alternative solutions you may think of were considered or result from your lack of understanding. It is clearly arrogant to think otherwise.
The CA graph they list there is nice, but it doesn't say much since many of the CAs there don't actually sell to consumers certificates, no?
Looking at this PDF[1] I see on page 23 that there are about 30 root CAs that have signed more that 1000 certificates. And (from page 21) it seems to me that the providers are very much US centric.
With regard to what does the SSL cert contain, I don't know much about this field, but I do know that the certificate may present and organization name and address/state/country. Hence I assume, identity also matters for some besides just domain ownership.
Anyhow, I'm not claiming I've found a better solution than the smart guys sitting down and working out solutions, but I do find annoying that the solution they found is so expensive for commoners.
As an armchair discussion, I still think that certificate info seems best to belong into a DNS record. DNSSEC perhaps could help with this?
If you doing online business, and successfully, the yearly charge shouldn't be such an issue. However, for non-profit websites its absolutely out of the question. I'm curious - as your customers aren't demanding SSL what industry are you in?
I mostly do contract work so I don't need SSL on my front-facing sites. We do use sites that have SSL to send deliverables and such, but I just pay for their service, not for the cert itself. Internally we've also used self-signed certs, our own CA or just SSH port forwarding.
As an industry we should move towards encription but away from the current CA model. Somehow everybody portrays it as if it's the same thing.
It seems to me we have a nice centralized monopoly here with the existing Certificate Authorities (most US-centric) for something as decentralized as the internet.
Why can't the domain name registrar give me a SSL cert for free? I mean, if I did buy a domain name, and I'm able to change the records, it's pretty clear I own the thing. Certificate info should just be a DNS record imho.
Regarding identity checks, there are other stupidities I see here: for example, my company has to send monthly/yearly papers to the government entities (some of which get publishes into some official government papers). Why can't I publish my public key there?
I mean, if anything, it's very bureaucratic to do anything involving public institutions so each paper is stamped, checked, etc.
I would trust more a local clerk to check for identity then some US guy that has never in his life actually seen a deed of incorporation for a Romanian entity.
So, yeah, I would love to have my site with HTTPS and to sign all my JARs and emails but until this becomes more sane or my customers actually start demanding it, I'm not going to waste money on that.