Let’s Encrypt gives away the certificate a website needs for HTTPS, thanks to sponsors including Cisco, Google and Akamai. It also automated the forms, waiting and server setup that made even a cheap paid certificate costly in time.
more
Why a $9 certificate still kept small sites off HTTPS
When Let’s Encrypt opened to the public in December 2015, a domain-validated certificate from an established authority could already cost as little as $9 a year. The price was not the biggest barrier. A buyer filled out forms, then waited hours for even the cheapest certificate to arrive. Once it turned up, the certificate and its key had to be downloaded and carried onto the server by hand. Only then could the web server be reconfigured for encryption. A less experienced administrator often copied a working configuration from whatever site claimed to have one. An outdated cipher setting could slip through unnoticed as a result. The whole job needed doing again every one to three years, whenever the certificate expired.
Just over a third of web traffic ran encrypted when the idea of giving that whole process away for free still looked, in Ars Technica’s words, “pretty outré.”
Run one command and it is done
Let’s Encrypt’s public beta went live at 1800 GMT on December 3, 2015. The Internet Security Research Group ran it, a California-based nonprofit overseen by people from Mozilla, Akamai, Cisco, Stanford Law School, CoreOS and the Electronic Frontier Foundation. Its certificates were already trusted by Chrome, Firefox and Internet Explorer on the day it opened. An administrator downloaded an open-source client and ran one command. The client requested a certificate, installed it and configured the server to use it. The certificate it produced passed muster too: a 2048-bit RSA certificate with a SHA-256 signature, good enough for an A grade from Qualys SSL Labs. Certificates had to be renewed every 90 days, so The Register advised automating renewal.
Why it caught on so fast
By April 2016, four months after that public launch, Let’s Encrypt had helped 3.8 million websites switch on HTTPS. Of those, 85% had never carried a certificate before. The 1.8 million certificates it had issued by then made it the third-largest certificate authority in the world, behind only Comodo and Symantec, according to Josh Aas, the founder of the Internet Security Research Group. Aas, who also works for Mozilla, put the case for encrypting everything in blunt terms. Anyone can pull unencrypted traffic down and read it, he said, and that is not what people should expect from a network this important. Encrypted page visits among Firefox users had climbed past 42%, up from 38.5% just before Let’s Encrypt launched. Aas said the rate was still rising by close to a percentage point a month. WordPress had announced days earlier that it would encrypt every site it hosted on a custom domain by default, using Let’s Encrypt’s certificates to do it.
Free was not the whole draw. Ross Schulman, co-director of the cybersecurity initiative at the New America Foundation, called the project “the silver bullet that… lowers the barrier to encrypted web communications,” because it brought the cost of running a secure site down to zero. Peter Eckersley, the EFF technologist who helped build Let’s Encrypt’s certification software, said future versions would go further, handling the “behind the scenes settings” that get HTTPS properly secured rather than just switched on.
A free certificate is not a background check
Being easy to get was not always a virtue. In January 2016, the security firm Trend Micro found Let’s Encrypt certificates encrypting a connection between malicious adverts on a website and a server run by cybercriminals. The criminals used that encrypted channel to install a banking trojan on visitors’ computers. A certificate only certifies that a connection is encrypted. It says nothing about who is on the other end of it.
From ten million certificates to a billion
The Electronic Frontier Foundation used the protocol Let’s Encrypt had built, since standardised and ratified by the Internet Engineering Task Force as RFC 8555. From it, the EFF built Certbot, a free tool that automates fetching, installing, configuring and renewing a certificate in one go. By June 2017, two years after launch, Let’s Encrypt had issued its ten millionth certificate. Encrypted traffic in the United States had risen from under 40% to 64%, and the project was serving 46 million websites on a staff of eleven and a budget of $2.61 million. It issued its billionth certificate on February 27, 2020, a little over four years after its first. By then it served 192 million websites and the US share of encrypted traffic had reached 91%. The project was running on a staff of just thirteen and a $3.35 million budget, barely more than it had three years earlier. The web did not get more encrypted because certificates got cheaper to make. It got more encrypted because Let’s Encrypt made them free to get, and automatic to keep.
