Certificates are not expensive, they can be picked up for $5.
At least one commercial CA issues free certificates as a matter of routine and (unlike CAcert) has its root certificate in all major OSes and browsers.
Alternatively, if you already have a paid cert then some providers offer a free cert via 'competitive upgrade' programmes, if you switch to them (rather unethically, this also used to work to freely upgrade short-term trial certificates to full ones).
You can get the same certificates for much cheaper here: https://www.thesslstore.com/
The certificates are absolutely identical, my customers use my site because it is well designed and easy to use and I do everything I can to provide great support, but if you know exactly what you are doing then I would recommend getting them directly from thesslstore - unless you have a desire to help pay for my uni education ;)
First, the site appears broken. The "Purchase SSL" link on the front page goes to a 404.
Second, the absolute cheapest certificate I could find anywhere was Certum's BasicID which costs $9.95 for one year.
Third, the dark pattern of presenting a lower price up front ($8), but then you find that this only applies if you spring for more than one year. Misleading and weak.
Finally, A wildcard certificate from the same company appears to cost $65.83/yr, (which goes up to $79.00 once you click on the link and realize that was the three year price.)
Not going to lie, this website leaves me feeling very skewed out, and still costs too much for what you're getting anyways.
Wildcard certificates are rarely economical compared with just buying individual certs for the subdomains.
> the dark pattern of presenting a lower price up front ($8), but then you find that this only applies if you spring for more than one year. Misleading and weak.
Absolutely agree!
If you send me an email then I'll make you a coupon to get a certificate for £5 (just over cost price) on my site: https://www.volcanicpixels.com/ssl/ (which is open source: https://github.com/volcanicpixels/volcanicpixels/)
Aside: the way you keep mentioning your URL over and over seems really spammy.
The process of obtaining an SSL certificate does not involve divulging your private key to the CA so what are you trusting them with? In reality you are trusting them not to sign certificates for sites not owned or administered by the person requesting it, they could (in theory) do this whether you got your certificate from them or not. In practice they cannot do this on a widespread scale without it being detected (e.g. Chrome sends info to Google if a certificate for a google domain is valid but not from the Google Internet Authority) and as soon as that happens then they lose their business (as is what happened to a CA that got hacked).
See how well that model worked with Comodo and TurkTrust - both of which are still in business and in default CA lists, which is counter to your assertion that careful CA operation makes business sense.
Unfortunately there's no will with browser vendors to _really_ improve matters (maybe TACK?), so something like CAcert is great should it get implemented (providing some heat to CA providers) and even when not (by showing the browser vendors' hypocrisy).
what would you say if I as a billionaire tell you that cars for less than 50 000 $ are not needed because all Ferraris are not expensive. So please don't use your subjective experience as an argument against cheap security solutions. They have a point to exist. Nobody should have the right to set the lower limit of how much you have to pay to secure your website. Commericial CAs cannot guarantee the security of your favorite site as we all learned from the heartbleed bug. So there is nit argument to favor them and block community solutions.
>If a 10 year old boy has a hobby website 5$ might be a price which is unacceptable. Why would this site need SSL?
Hobby sites quickly become apps (even as small as phpBB) and it would be good if we SSL'd everything.
A 10 year old with a hobby site in a third world country doesn't need a $5 certificate. Neither does a rich 10 year old with a hobby site for that matter, but he can purchase one if he wants.