Hacker News Reader

Comment by Kwpolska | Hacker News Reader

Browsers also keep lowering the maximum validity period: https://www.theregister.com/2025/04/14/ssl_tls_certificates/

Not just browsers, CAs voted in favour too.

To me, this seemed like turkeys voting for Christmas.

Plenty of businesses with legacy systems will happily pay $300/year for a 1-year SSL certificate, because they haven't automated renewal, and don't need to over a mere $300. This lets for-profit CAs provide something Lets Encrypt doesn't offer.

I don't get why they'd give up their one competitive benefit? Surely every customer of a paid CA is an organisation that hasn't automated certificate rotation?

Short-term, it'll get rid of a bunch of competitors who are slower at setting up automated renewal infrastructure.

Mid-term, it'll reduce the risk of noncompliance, as large customers can no longer demand that you delay revocation. CAs no longer have to fear customers switching to their competition.

Long-term, it'll reduce their operating cost, as it is no longer necessary to handhold customers through the certification issuance and installation process. You just give them a URL, id, and key to enter a single time, and it should Just Work.

The revenue loss of small customers can be compensated by regulatory capture and price hikes for EV. Tell the politicians that "everyone can get a basic cert these days", and that the really important stuff (like banking, hospitals, power grids) should be forced to buy EV certs.

> Long-term, it'll reduce their operating cost,

It doesn't matter how far you reduce your operating cost, if your revenue falls to zero.

> The revenue loss of small customers can be compensated by regulatory capture and price hikes for EV.

Hah, that's a good one.

Sure, google.com and microsoft.com and amazon.com and godaddy.com and letsencrypt.org and facebook.com and twitter.com and cloudflare.com and coinbase.com and and visa.com and entrust.com don't need EV certificates... but you do.

Maybe that's the point of the big players making things harder for small business to operate independently. You want to put up shop online? Just use our services (eg Shopee, Temu, Amazon) to sell online and they get a cut on all your transaction. All the big players get a cut on every commerce on the internet. Want to put up a payment system not under their system? Their lobbies will take care of your startup before it even starts.

> Tell the politicians that "everyone can get a basic cert these days", and that the really important stuff (like banking, hospitals, power grids) should be forced to buy EV certs.

Google removed all the verification markers from chrome in September 2019 - because they investigated them and nobody understands a green box means verification.

Yes, the obvious answer is: make the verification UI look like every other verification UI, but they didn’t did test that. The chrome team, specially ryan sleevi, thinks regular people should understand DNS. You know - apple.com.store/ipad isn’t Apple, and that withgoogle.com is actually Google.

Reply on news.ycombinator.com