About the elephant in the room: Let’s Encrypt is becoming too big to fail. Wasn’t the point of open sourcing the whole protocol so that we could have multiple CAs like Lets Encrypt?
Additionally, other impact-focused people (non-profits, etc.), who would otherwise be willing to make a free CA, probably think Let's Encrypt is doing good enough, so why waste valuable time making the same thing when you could focus on having an impact elsewhere?
I suspect this is a pretty common end result in public-good tasks that don't have business models. They naturally grow to be too big to fail. Some governments try to solve this by just absorbing the task and making it a part of the government's responsibilities. I doubt this would happen for Let's Encrypt, so I guess we'll be stuck with a too-big-to-fail non-profit until it fails, starts to suck too much, gets absorbed by the government, or someone figures out a business model.
There no reason they can't charge money for certificates issued through it, or in fact use it for EV certificates (after a separate initial verification process).
Is the market size of people who would like to automate certificate renewal but want to use a commercial CA zero?
There are a couple of reasons why none are available today. First, ACME isn't quite standardized yet. Let's Encrypt currently implements an older draft and will start offering an ACME server running what will become the RFC version of ACME early next year. It makes sense for other CAs to wait for the standardization process to finish (hopefully while working on their own implementation and giving feedback!) rather than implement the draft currently supported by Let's Encrypt and all clients, and then migrating to an incompatible new version soon after. Going live with a server supporting the latest draft wouldn't make much sense either since clients wouldn't work with it.
Another reason is that the later drafts saw a couple of additions and changes that are relevant for commercial CAs, for example things like the ability to bind ACME accounts to existing CA accounts and around the way out-of-band processes are handled (payments, validation steps that cannot or must not be automated). This was done based on the feedback from a small number of commercial CAs that were active in the working group and should hopefully make ACME a viable option for many others.
Thanks - this is exactly the type of summary I was looking for.
And if you think it's too big to fail, I encourage you to start your own ACME-compatible sister CA to Let's Encrypt. And if you're now realizing you don't have the resources to do that, you just answered your own questions (but you can still donate to the EFF or to Let's Encrypt directly: https://letsencrypt.org/donate/)
But you're right about trying to run another public LetsEncrypt style CA. Getting your root cert signed and into browsers is a major undertaking and I'm really glad we have LetsEncrypt. We might be tied to one big provider, but everything they've done is open if other people want to attempt it.
First, because certificate issuance is automated, if Let's Encrypt ever had to migrate to a new root cert they could do so in a way that's almost completely transparent to its clients. Aside from sites that have the old roots pinned, Let's Encrypt could simply start signing new certs with a different root and everyone could just carry on like nothing happened.
Second, because of the low validity period on Let's Encrypt certs, if such a transition did become necessary the entire process could be completed in ~90 days. This is in contrast to other "too big to fail" CAs (e.g. Symantec), where the process of distrusting the old roots takes years.
These factors don't eliminate the concern entirely, of course, but they do make the overall situation much better.