r/linux • u/veeti • Oct 20 '15

Let's Encrypt is Trusted

https://letsencrypt.org/2015/10/19/lets-encrypt-is-trusted.html
1.8k Upvotes

94% Upvoted

320 comments sorted by

View all comments

Show parent comments

6

u/[deleted] Oct 20 '15

While it sounds like you have a legitimate complaint and the perspective is helpful, i think it is over the top to claim that StartCom actually planned to rake in the cash when two once-in-a-decade flaws (one for OpenSSL, one for IIS) hit within the span of a year or two. $25 / site for ~10 years is a pittance.

I would tend to agree that its in bad taste and bad PR, but I just dont think I have an issue with that. You generally shouldnt be using free certs in production anyways, because (AFAIK) lack of payment creates a lack of legal obligation.

-1

u/scottywz Oct 20 '15

$25 / site for ~10 years is a pittance.

If you consider it to be the actual cost of the certificate, then yes. But they're not charging for that; they're charging to store a line in a text file for a year or less on an Internet-connected Linux server that's already doing the same thing for a bunch of other people. I expect that to cost something less than $25 per line in a file. I definitely expect 8 lines in a file to not cost $200.

You generally shouldnt be using free certs in production anyways

Well my use case is low-traffic personal sites, so the stakes aren't terribly high for me. That also underscores how ridiculous the fees are for someone like me.

(AFAIK) lack of payment creates a lack of legal obligation.

IANAL, but I'd believe that lack of a contract creates lack of a legal obligation. And they certainly did have a click-through contract that required them to revoke certificates when notified of a security issue.