<story><title>The SSL Co-operative: A Member-Controlled Certification Authority</title><url>http://www.sslcoop.org/</url></story><parent_chain><item><author>JoshTriplett</author><text>I&amp;#x27;ll say the same thing here that I said in a response to the survey: I&amp;#x27;d be interested in taking part in a CA co-op that seeks membership&amp;#x2F;sponsorship to cover its infrastructure costs (including the huge initial cost of becoming an accepted CA), but that does not charge to issue certificates, including wildcard certificates.&lt;p&gt;Certificates cost approximately nothing to issue, and most of the CA&amp;#x27;s infrastructure would not need significant scaling with the issuance of more certificates.&lt;p&gt;Manual validation of human&amp;#x2F;organization identities (the type that requires reading identity documents, such as for EV) costs money, and that could have associated fees, but it doesn&amp;#x27;t need to occur on a per-certificate basis.  And automatable validation costs nothing.&lt;p&gt;In particular, wildcard certificates don&amp;#x27;t need to cost any more than standard certificates, and no-cost wildcard certificates would change the SSL landscape significantly.  Today, any service that uses subdomains incurs significant fees to secure those subdomains.</text></item></parent_chain><comment><author>dtech</author><text>StartSSL&amp;#x2F;Startcom already does not charge for individual (wildcard) certificates, you can request unlimited numbers.&lt;p&gt;You do pay a $60 fee for identity validation, which is valid for 2 years. You can also have automated validation, but they don&amp;#x27;t allow wildcard certificates (which I sort-of understand, they do need to make money some way right)&lt;p&gt;So you get unlimited free non-wildcard certificates or unlimited wildcard certificates for $30&amp;#x2F;year. Not a bad deal.</text></comment>
<story><title>The SSL Co-operative: A Member-Controlled Certification Authority</title><url>http://www.sslcoop.org/</url></story><parent_chain><item><author>JoshTriplett</author><text>I&amp;#x27;ll say the same thing here that I said in a response to the survey: I&amp;#x27;d be interested in taking part in a CA co-op that seeks membership&amp;#x2F;sponsorship to cover its infrastructure costs (including the huge initial cost of becoming an accepted CA), but that does not charge to issue certificates, including wildcard certificates.&lt;p&gt;Certificates cost approximately nothing to issue, and most of the CA&amp;#x27;s infrastructure would not need significant scaling with the issuance of more certificates.&lt;p&gt;Manual validation of human&amp;#x2F;organization identities (the type that requires reading identity documents, such as for EV) costs money, and that could have associated fees, but it doesn&amp;#x27;t need to occur on a per-certificate basis.  And automatable validation costs nothing.&lt;p&gt;In particular, wildcard certificates don&amp;#x27;t need to cost any more than standard certificates, and no-cost wildcard certificates would change the SSL landscape significantly.  Today, any service that uses subdomains incurs significant fees to secure those subdomains.</text></item></parent_chain><comment><author>raving-richard</author><text>Pretty much what I was thinking. Here&amp;#x27;s what I almost sent as a response to the survey: 
This is a brilliant idea. I would pay up to $50 a year for the pleasure of being able to get domain validated SSL certs that are trusted by the major browsers. I would assume that the validation would be via emailing webmaster@domain and making them either respond or click a link or something. That could all be automated couldn&amp;#x27;t it.&lt;p&gt;Also, make wildcard certificates for domains available for the same low price, because it shouldn&amp;#x27;t take any more work should it. If I control example.org, then I think it&amp;#x27;s obvious that I control www.example.org and slighly-biased.example.org.&lt;p&gt;But then you have the issue of, if Org A controls com.au, that doesn&amp;#x27;t mean they control mywebsite.com.au. I don&amp;#x27;t know how you would automate that issue.&lt;p&gt;The non-automated stuff, make people pay for it. Seriously.</text></comment>