internet terms-of-service encryption
Does selling certificates from Let&#39;s Encrypt violate their ToS?
<p>A company I (unfortunately) worked for in the past is selling Let's Encrypt certificates for about 10€/month. I don't need to tell you that these certificates are free for everyone. The customers are not getting any information about what certificate they are buying.</p>

<p>Is it against the ToS of Let's Encrypt to do this?</p>

<p>According to Josh Aas, Internet Security Research Group (ISRG) Executive Director, (the umbrella 501(c)(3) for Let's Encrypt):</p>

<blockquote>
  <p>"It is not against our terms to charge for services using our
  certificates, though we'd strongly prefer that HTTPS just be part of
  every offering as a default with no additional fees." <a href="https://community.letsencrypt.org/t/my-host-sells-ssl-letsencrypt-certificates/26642" rel="nofollow noreferrer">My host sells SSL letsencrypt certificates - Help - Let's Encrypt Community Support</a></p>
</blockquote>

<p>That said, what your old company is doing is charging for their time and expertise (aided possibly by their own automated software they developed) to install SSL certificates for their own webhosting customers on their own servers.</p>

<p>The company is not reselling the SSLs; they are selling <em>the service</em> of installing the certificates.</p>

<p>It's not easy to install and automate the updating of 90-day SSLs from Let's Encrypt. So what your old company is doing is making it easy - for a fee - for their customers to use a somewhat difficult to use free service with the rest of their paid webhosting.</p>

<blockquote>
  <p><em>The customers are not getting any information about what certificate
  they are buying.</em></p>
</blockquote>

<p>That could be. Check the TOS and information that each customer gets when they use the webhosting service with an SSL from Let's Encrypt. Many customers may only be concerned with if the SSL works, or not.</p>

<p>And I'm sure the webhosting company does not divulge all aspects of their services to their customers, especially concerning security of their webservers and other business systems.</p>

<p>Many countries have consumer protection laws that would limit this kind of sale, but those laws are not completely uniform within the E.U. So there may be legal liability separate and apart from the ToS issue.</p>

<p>The <a href="https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf" rel="nofollow noreferrer">ToS for Let's Encrypt</a> is governed by California law and contains the following provision that may be pertinent, although it could be more clearly drafted:</p>

<blockquote>
  <p><strong>You warrant that You will not use Your Certificates to</strong> attack, <strong>defraud</strong>
  or intercept the traffic of others.</p>
</blockquote>

<p>The ToS also implies that Certificates are issued directly to an end user and are not for resale which would involve misleading registration information. But, as BlueDogRanch's answer shows, the company does not take the position that resale is barred by its ToS.</p>

<p>The hard part is who is equipped to do anything about it. While the justification provided by BlueDogRanch in that answer is colorable, meaning it could be difficult lawsuit to fight, I doubt that it would prevail on the merits in a jury trial.</p>

<p>The company could take action, but it is hard for them to invest much in policing a free service and it doesn't seem interested in doing so. </p>

<p>There could be consumer protection agencies (perhaps applying California false advertising laws that are probably being violated here) and perhaps a class action lawsuit. </p>

<p>The smart choice for an individual who is duped is to stop paying for something free.</p>
