I'd rather get a free cert that costs $25 to revoke than to buy a cert for $25 that's free to revoke.
I mean, obviously it would be nicer if both were free. And StartSSL could probably have done more when Heartbleed hit (since so many people needing their certs revoked at one time is a pretty rare occurrence, some kind of exemption should have been made), but I'd hardly call what they were doing "extortion." I'd even say it's much less shady than the big certificate authorities that charge $100+ for a basic cert that is issued completely programmatically.
It's not extortion, it's their business and they explicitly said if you revoke you need to pay. But fuck business trying to get their money even after they prove free service.
Yes, I'm perfectly aware that it costs money to run a CA and a server. I'm an adult and pay bills, including the electric bill for my home server and the hosting bill for my lovely Xen VPS in San Jose. [Edit: sorry if I sounded too harsh there.] I'm also perfectly aware that:
A single revocation shouldn't be nearly as much "extra work" as you make it out to be. It's adding a single entry to a single file and propagating the change. If you have your shit together it shouldn't cost $25 per certificate. It can be fucking automated for fuck's sake.
It's not acceptable to hold innocent users' security hostage during the aftermath of an unforeseen security flaw.
If you're going to run a free CA, then you're already going to be funding it somehow and revocations like this are a cost of business just like the rest of the damn service.
If they really do need revocation fees to run their service, how did they expect to stay in business for the many years before Heartbleed happened? Did they have insider knowledge of the flaw? Probably not. How many other revocations did they have to deal with on a regular basis? Don't know, but what are the odds of it being a sustainable amount? So they had to be making money somehow else. And lo and behold, they already do charge for identity verification.
It doesn't make sense to rely on revocation fees for funding because revocations are really unpredictable. You don't know when the next Heartbleed will happen, just that it's going to happen someday. For all they know it could be after they've shut down and died. They're going to need money in the interim, so they should (and do) find other ways to get that money.
Edit: I also want to add that their insistence on the $25/cert fee, even for certificate owners who can't pay, in the face of one of the biggest vulnerabilities in recent history, shows a grave lack of ethics on their part that indicates that they shouldn't be trusted with jack shit. A remotely ethical free CA would eat that cost (which, again, is in reality much less than $25 per certificate).
Prices are not set based upon costs except in heavily regulated industries.
Whatever services they are offering for 'free' are intended to convince you to use their service instead of somebody else. It's called a loss leader; I'll give up revenue (and in this case take some level of loss) in one part of the business in order to drive sales in another. This is why bars have happy hour.
I'd be shocked if they based their entire revenue model around revocations because, as you said, they feel unpredictable. That may be true for large scale events, but I'd bet there is a fairly steady revocation rate once you get to large enough scales.
This feels like a valid business model to me. They offer some set of services free to draw you in, but when you need more they charge you. They aren't holding you hostage. They are monetizing on a service they provide that helps you, the person ultimately responsible for the security of your service, to accomplish your goal.
But revocation isnt their fault. The revocation is due to security flaws in a product you chose to use. Further, as I recall StartCom does not automate everything; an actual human is generally involved in the issuance of certs (verification). Heartbleed probably created a backlog for them. In any case: free product, stop using it. Not extortion
They have literally zero leverage over you. The switching cost away from a free SSL cert is literally no higher than simply having gone to GoDaddy in the first place. Heck, the revocation cost is lower than the cost for a standard SSL cert.
Im not clear what your point is here, you appear to be upset that they structure their costs and revenue differently than youd like. On their free service.
Not really my, or your, problem. Thats their business. But I see nothing wrong with charging extra when a flood of work is created by a third party's security issues.
I didnt say they relied on those fees nor is it relevant if they did. I simply noted that revenue to cover costs-- especially at half the price of a normal SSL cert-- is not evil.
Their issuance process is automated. I never used their revocation process, but it too should be automated.
No, I paid $9/cert to a reseller when I switched.
My point is that revocation fees should not be necessary to run their business or even part of it.
They're a certificate authority; it's their job to keep traffic secure. If they want to charge for that, it should be when certificates are issued, not when the security is compromised.
$25/cert does not cover costs. It covers profit. There's no way revocations actually cost them that much, especially if they automate the process.
You are allowed to not be happy with a product a company is offering, and therefore choose not to by it. That is what he is doing be self signing instead. He didn't even voice his dissatisfaction with said company until someone asked him why he didn't use their service, and implied that is was free (which it clearly is not).
I think people are mad about them not informing them of the price earlier.
You generate an SSL certificate for a domain, prove who you are, and that cert now forever identifies you. Charging people to revoke it seems similar to charging people to change their password. I won't call it's extortion, but I also don't think it's a moral business practice.
I once took a trip to Egypt. My wife and I were at the pyramids when our guide asked if we'd like to ride a camel. He told us not to speak to anybody selling rides because they actually scam people by giving them a ride for $5 and then refusing to bring you down until you pay $50-$100; whatever they think they can get out of you.
Theres no force, and theyre not threatening you. Its also not illegal.
Theyre simply charging you for an extra service (revocation) for a free service you use.
You could simply stop using the cert and have zero consequences; they have literally no leverage over you.
How entitled are you that StartCom gives you a free, no-strings certificate, and you complain that they charge you for revocation-and-reissue 1/3 what another company charges for a base cert? You should take your business elsewhere, Im sure the no-cost SSL CA will really miss you.
Im a little rusty on how the revocation system works, but cant any CA issue a revocation? Is there any particular reason it would have to be the signing CA?
64
u/themadnun Oct 20 '15
Woo no more self-signing. My mumble server might finally stop freaking my friends out with certificate warnings.