Let's Encrypt

Let's Encrypt. It is a certificate authority operated by the Internet Security Research Group that provides free X.509 certificates for Transport Layer Security encryption via an automated process designed to eliminate complex manual creation, validation, signing, installation, and renewal. The service, launched publicly in December 2015, aims to create a more secure and privacy-respecting World Wide Web by making it simple and cost-free for website operators to enable HTTPS. Its issuance process is governed by the Automated Certificate Management Environment protocol, which has since become an Internet Engineering Task Force standard.

History and founding

The project was conceived in 2012 by Mozilla employees Josh Aas and Eric Rescorla, with early support and sponsorship from the Electronic Frontier Foundation and the University of Michigan. The founding organization, the Internet Security Research Group, was established to oversee its development and operations. A public beta period began in late 2015, leading to a full public launch on December 3, 2015. Key milestones included achieving issuance of one million certificates within a few months and crossing one billion certificates issued by 2020. The initiative was a direct response to the historically high cost and administrative complexity of obtaining certificates from traditional commercial authorities like DigiCert, Sectigo, and GlobalSign, which were seen as barriers to universal Internet security.

How it works

The system relies entirely on the Automated Certificate Management Environment protocol, a standard developed in collaboration with the Internet Engineering Task Force. A website administrator uses an ACME client, such as Certbot (developed by the Electronic Frontier Foundation), to perform domain validation. This typically involves the client proving control of a domain by responding to an HTTP challenge or creating a specific DNS record. Once validated, the client software automatically generates a cryptographic key pair and sends a Certificate Signing Request to the authority's servers. The signed certificate is then issued and can be automatically installed on web servers like Apache or Nginx. The entire lifecycle, including renewal every 90 days, is designed for complete automation, minimizing human intervention.

Impact and adoption

The service has dramatically accelerated the global adoption of HTTPS. Prior to its launch, major web entities like Google and the World Wide Web Consortium had been advocating for pervasive encryption. Let's Encrypt's free and automated model provided the critical infrastructure to make this feasible for millions of website operators, including small businesses, open-source projects, and personal blogs. By 2020, it had become the largest certificate authority in the world by volume of certificates issued. Its success pressured traditional certificate authorities to lower prices and offer similar free, basic certificates. The widespread adoption it enabled contributed significantly to browsers like Google Chrome and Mozilla Firefox marking non-HTTPS sites as "not secure."

Technology and certificates

The authority issues Domain Validation certificates, which verify control over a domain name but do not validate organizational identity. It uses a robust and transparent infrastructure for its own operations, with its root certificates cross-signed by IdenTrust to ensure immediate trust in all major browsers and operating systems, including those from Microsoft, Apple, and Google. The certificates are standard X.509 files and support modern features like Subject Alternative Name fields. The short 90-day validity period for certificates is a security design choice intended to limit the impact of key compromise and encourage fully automated renewal processes, a practice now adopted more widely across the Public key infrastructure industry.

Governance and funding

Let's Encrypt is operated by the Internet Security Research Group, a California-based public benefit nonprofit. Strategic decisions are guided by a board of directors. The project relies on sponsorship and donations from a broad consortium of technology companies, nonprofits, and academic institutions. Major financial supporters have included the Electronic Frontier Foundation, Mozilla Foundation, Cisco Systems, Akamai Technologies, Google, Facebook, and the Ford Foundation. This funding model ensures the service remains free and independent, aligning with its mission to provide a public benefit for the security of the Internet.

Category:Computer security Category:Internet organizations Category:Certificate authorities Category:Non-profit organizations based in California