Although the production costs are free, the maintenance costs (both short and long term) to make the certificates have any worth to purchasers is very significant.
Ignoring wages, hosting, DR site maintenance, general business costs etc, the other maintenance costs I can see over other SaaS/webhosting/domain businesses (which are similar).
mid $xxxxx/mo for CDN hosting
mid $xxxxx startup for the hardware (you can't store keys on disk)
mid $xxxxx anually for audit (thats the simple cost to get it done, nothing to do with performing it - manpower, expenses, recification of any issues)
[Sometimes multiplied for various other compliancies/audits around the world]
It's like this:
Webhosting - you can pay $100 a year for mid-to-low-end hosting.
You could probably do it yourself from your ADSL line, or a cheap co-lo, right? Save a few bucks.
SSL - you can pay $100 a year.
Or, unlike hosting/SaaS, even becoming your own domain-reg...you're looking at the above costs, plus waiting with your thumbs up your ass for 5+ years before you can do anything. Still paying, too.
You could bypass the wait, shell out for the hardware and then pay 6-7 figures to get a subCA and issue immediately.
Rip-off? Not as clearly as you think.
