Free S/MIME certificate authority, the Let's Encrypt of email encryption
Problem
Encrypted/signed email via S/MIME is effectively locked behind paid CAs — there is no free, automated authority like Let's Encrypt did for TLS. Individuals and small businesses who want baseline email signing/encryption face annual fees and manual renewal rituals for what should be commodity infrastructure.
Opportunity
A nonprofit-style free CA issuing short-lived S/MIME certs with automated renewal (ACME-style), lowering email authentication to zero cost and driving adoption across mail clients.
Market analysis
The infrastructure gap is real — no free, automated S/MIME CA exists — but the reason is structural: CA/Browser Forum S/MIME Baseline Requirements, identity-verification obligations, audit and legal liability make a free CA a nonprofit fundraising problem, not a startup.
Market · Privacy-conscious individuals, small businesses and regulated senders (EU) who want signed/encrypted mail; niche but persistent demand, recurring in HN threads.
Pricing · Paid certs run €9-75/yr (Sectigo PAC Basic ~€9.49, GlobalSign ~€33-42, Actalis OV €60+); Actalis offers a free mailbox-validated tier with security limitations, so the price anchor is already near zero.
Pros
- + Genuinely unserved niche: no ACME-automated free S/MIME authority exists today.
- + Short-lived certs with auto-renewal would remove the annual renewal ritual users hate.
- + Strong goodwill/HN-visibility potential, mirroring the Let's Encrypt playbook.
Cons
- − Not a business: free nonprofit CA needs sponsors, audits and legal accountability indefinitely.
- − Let's Encrypt itself has publicly declined S/MIME issuance for years — a signal about viability.
- − Adoption is gated on mail-client UX, which the CA does not control.
Source
Hacker News (Ask HN)
The uncomfortable truth from the Let’s Encrypt community thread is that the obstacle is not technical but economic and regulatory: S/MIME baseline requirements bind the CA to identity-verification duties, audits and liability that a donation-funded org must carry forever, and mail clients still make installation painful no matter what the CA does. The realistic version of this idea is an ISRG-style nonprofit with anchor sponsors, which is a multi-year governance project — a solo builder’s leverage here is near zero. Note also that Actalis already occupies the “free-ish” slot, complete with the trust caveats that a better-run free CA would need to overcome.