Hacker News Reader

Comment by vlovich123 | Hacker News Reader

Does anyone know the backstory behind how they found a cert company to cross-sign? Doesn’t letsencrypt completely kill their business model?

View on HN

Let's Encrypt killed the business model of selling domain-validated certificates for $10 a year. (Much more if you wanted a wildcard!)

A company like RapidSSL or GoDaddy would never have cross-signed Let's Encrypt, unless they offered "buy our whole CA business" money.

But selling DV certs wasn't IdenTrust's business model, so they were happy to provide a cross-signature for (according to some speculation elsewhere in this thread) less than six figures. And because of how TLS root certs work, a cross-sig from IdenTrust was just as useful to LE as a cross-sig from one of the ultra-profitable CA's.

If I were a cert company whose target market were large enterprises unlikely to use LetsEncrypt, I would do it in order to undermine my competitors who might depend more on small businesses and other types of projects that find LetsEncrypt appealing.

Presumably they convinced them by paying them money. :D And if they didn't do it, someone else would have.

It seems IdenTrust has not been killed off.

    1  IdenTrust  48.5%  53.6%
    2  DigiCert Group  13.1%  14.5%
    3  Sectigo (Comodo Cybersecurity)  12.1%  13.4%
    4  GlobalSign  6.1%  6.7%
    5  Let's Encrypt  5.8%  6.4%
    6  GoDaddy Group  4.8%  5.3%

https://en.wikipedia.org/wiki/Certificate_authority

Those numbers are misleading. IdenTrust has always been a small CA in terms of volume. The large percentage you see for them there is actually Let's Encrypt volume counted as IdenTrust because of the cross-sign. The Let's Encrypt percentage there is from sites not using the cross-sign. Add them together and that is basically Let's Encrypt's total volume, as IdenTrust itself is likely < 1%.

> Doesn’t letsencrypt completely kill their business model?

Not at all. Major cert authorities are all selling to businesses, and that will continue to be the case. Letsencrypt's users are almost all in the personal/hobbyist space.

Our company uses Let's Encrypt for HTTPS traffic on our own internal networks. It is free, convenient, and cert-manager handles it all "auto-magically" for us.

> Letsencrypt's users are almost all in the personal/hobbyist space

That may have been true in the early days of Let's encrypt. But today, if you're using any of a number of newer hosting options (Netlify, Vercel, Fly.io, etc.) you're probably using a let's encrypt certificate.

Older/more staid companies will mostly still be using certs from Digisign et al., but there's little reason for new companies to pay for that.

> AWS, Google Cloud

How so?

> Netlify, Vercel, Fly, etc.

For the default URLs generated when you deploy an app, sure, but companies using them commercially are all bringing their own domains (with their own certs).

Nope - having built out the SSL termination stack for a similar company - they are serving millions of commercial sites on their own custom domains with let's encrypt issued certs.

Not true. Major entities and enterprises are using LE. https://community.letsencrypt.org/t/list-of-major-websites-w...

Additionally, in the early days of letsencrypt there was more reason to buy some form of extended-validation EV/OV cert (which lets encrypt does not provide) than there is now, with browsers no longer providing UX distinguishing such.

There's this perception that businesses like to throw money away that they don't have to.

When LE came out they already had multi-year certificates, so they just used those. At the time many were convinced to switch from DV to EV [1] certificates. Since then the (alleged) benefits of EV certificates have vanished. [2]

Thus the argument to spend budget money on thing-we-can-get-for-free is very thin. Sure, there are some die-hards, but since they are literally wasting money they become fewer either each passing day.

[1] DV = Domain Verified which is what LE issues. EV is Extended Verification and costs several hundred $.

[2] Off the top of your head name 3 domins you visit that use an EV certificate. You can't because you can't tell if they do or not. And since no-one cared when you -could- tell, no-one complained when bring able to tell went away.

[3] LAN certificates was the last "hurdle" and that's been automated away as well. So now those spending money on CAs are just using up their budget, and not getting something for it.

That's an illussion big CAs want to sell. It's not true. Plenty of businesses use Let's Encrypt certificates.

From a technical point of view there is no reason a business cannot use Let's Encrypt. The certificates provide exactly the same security. There is really no difference in the encryption you need for a "personal/hobbyist" site or a business site.

Yeah, CAs still successfully convince some businesses to pay a premium, because they don't understand how TLS works. That mostly works because in "business terms" the price is still low.

I worked with a large CDN provider (not that one, the other one) who would rubbish LetsEncrypt in meetings -- then note that they use LetsEncrypt themselves for domain validated certificates. So we should pay them extra for OV certificates, the logic of which only makes sense to their salespeople.

My employer isn't a heavy user of LetsEncrypt, as AWS's certificate issuance is more straightforward to use when we're already using AWS for pretty much everything. But we still have a few hundred LE certificates that are in active use.

Reply on news.ycombinator.com