> Finally, it will significantly reduce our operating costs, allowing us to focus our funding on continuing to improve your privacy and security.
Does that imply they are paying millions or something for the cross-sign?
Does that imply they are paying millions or something for the cross-sign?
In that same year, their total expenses were $5.1M - so that expense would make up almost 10% of their budget.
[0]: https://beta.candid.org/profile/9328188?keyword=46-3344200&a...
We are sincerely glad to have them as partners, and grateful for their contributions to helping get Let's Encrypt going. We could not have done what we did without them. Running a publicly trusted CA is not easy, and cross-signing others involves work and liability, particularly if the entity asking for a cross-sign is an upstart with a strange plan and little to no experience running a CA.
Imagine if a CA cross-signed some new, upstart CA to get them browser compatibility (like IdenTrust did for LE), and then the new upstart went rogue and started issuing phony certs for google.com, wikipedia.org, etc. on behalf of [insert totalitarian nation here] state security. Those certs would chain up to the cross-signer's root, and they're responsible for it. They could face removal from root programs if they were reckless about cross-signatures.
So if a root CA wants to cross-sign a new CA, they need to make sure that the new CA follows the same policies and gets the same audits as a root CA, because their ability to break things will be basically equivalent to a root CA.
Honestly, <$500k for all the admin work on this sounds reasonable to me. It probably took a huge portion of several people's time throughout the year.
> In addition, dropping the cross-sign will reduce the number of certificate bytes sent in a TLS handshake by over 40%