(The letsencrypt.org CA is build around automated certificate issuance through an API, but some competition wouldn't be a bad thing.)
We have both an API and a highly scriptable open source command line client.
> DV certificates are $15.95/year per domain,
Not a bad price, very much one I'd be willing to pay in order to get certificates via a CLI.
> or $149.95/year for unlimited sub-domains.
Ouch, 10x for a wild card? Why do issuers do this? It really puts a crimp on the whole "hobbyist doing hobbyist things" since that's $150/year just to not have cert errors on a single domain.
(FWIW, I'm deliberately excluding StartSSL for a variety of reasons.)
What do you mean about cert errors on a single domain [requiring a wildcard]? Because you use a lot of subdomains, or the bare domain/www. prefix?
If it's the latter, I think some (many?) registrars may let you add one or more SubjectAltName[1] values to a single cert for free or minimal cost, at least compared to a wildcard.
[1] Other values for which the certificate is considered valid: https://en.wikipedia.org/wiki/SubjectAltName
Wildcard SSL
$149.95
/ year
- an admin-looking email address
- email mention in whois
- ability to upload a file
- ability to add a DNS TXT record.
Yes, that's a fairly low bar, that's why live.com gets taken over every few years with the same fake-DV-cert attack. This is also why EV certificates exist. Disclaimer: https://certsimple.com, where I work, sells EV certificates, we specifically don't sell DV certs.
I'd consider myself relatively security-savvy and I honestly couldn't tell you which of the sites I visit uses EV certs, and I'm fairly sure I wouldn't notice the browser bar change from green if a site got MITM'd with a valid DV cert after having an EV cert.
Pinning obviously helps in that case but AFAIK that works just as well for DV certs as EV.