If by "money" you mean $99 to buy a certificate from Verisign. Debian also has $99 to throw at Verisign, it's just making up its mind as to whether it wants to.

I'm not saying I'm happy about any of this, but complaining about the money makes you sound exactly as credible as someone calling Ubuntu suckers because they pay for SSL certificates. (Especially because SSL has all the same issues of root keys owned by rapacious trusted third parties, and a security benefit that isn't obviously that big, these days...)