0

A company I (unfortunately) worked for in the past is selling Let's Encrypt certificates for about 10€/month. I don't need to tell you that these certificates are free for everyone. The customers are not getting any information about what certificate they are buying.

Is it against the ToS of Let's Encrypt to do this?

  • 1
    Are you absolutely sure they are selling the certs themselves? Or charging for the service to install and update the certs? The SSL certs are registered to the domain, not the webhost. What does the company's TOS say about the certs they install on behalf of their webhosting customers? – BlueDogRanch Sep 1 '17 at 19:15
2

According to Josh Aas, Internet Security Research Group (ISRG) Executive Director, (the umbrella 501(c)(3) for Let's Encrypt):

"It is not against our terms to charge for services using our certificates, though we'd strongly prefer that HTTPS just be part of every offering as a default with no additional fees." My host sells SSL letsencrypt certificates - Help - Let's Encrypt Community Support

That said, what your old company is doing is charging for their time and expertise (aided possibly by their own automated software they developed) to install SSL certificates for their own webhosting customers on their own servers.

The company is not reselling the SSLs; they are selling the service of installing the certificates.

It's not easy to install and automate the updating of 90-day SSLs from Let's Encrypt. So what your old company is doing is making it easy - for a fee - for their customers to use a somewhat difficult to use free service with the rest of their paid webhosting.

The customers are not getting any information about what certificate they are buying.

That could be. Check the TOS and information that each customer gets when they use the webhosting service with an SSL from Let's Encrypt. Many customers may only be concerned with if the SSL works, or not.

And I'm sure the webhosting company does not divulge all aspects of their services to their customers, especially concerning security of their webservers and other business systems.

1

Many countries have consumer protection laws that would limit this kind of sale, but those laws are not completely uniform within the E.U. So there may be legal liability separate and apart from the ToS issue.

The ToS for Let's Encrypt is governed by California law and contains the following provision that may be pertinent, although it could be more clearly drafted:

You warrant that You will not use Your Certificates to attack, defraud or intercept the traffic of others.

The ToS also implies that Certificates are issued directly to an end user and are not for resale which would involve misleading registration information. But, as BlueDogRanch's answer shows, the company does not take the position that resale is barred by its ToS.

The hard part is who is equipped to do anything about it. While the justification provided by BlueDogRanch in that answer is colorable, meaning it could be difficult lawsuit to fight, I doubt that it would prevail on the merits in a jury trial.

The company could take action, but it is hard for them to invest much in policing a free service and it doesn't seem interested in doing so.

There could be consumer protection agencies (perhaps applying California false advertising laws that are probably being violated here) and perhaps a class action lawsuit.

The smart choice for an individual who is duped is to stop paying for something free.

  • I'm not sure the OP knows if the certs themselves are being sold, or if it is simply the service to install and update the certs is being sold. SSL certs are tied to a domain, not a webhost, so the webhost may sell a service to install a cert on the webhost, but the cert is tied to the domain, which is probably owned by the individual. – BlueDogRanch Sep 1 '17 at 19:13
  • @BlueDogRanch The facts do seem a bit muddy. – ohwilleke Sep 1 '17 at 20:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.