How Let's Encrypt Revolutionised Web Security

Posted on 29 August 2024 Reading time: 5 min read
How Let's Encrypt Revolutionised Web Security

Introduction

SSL (Secure Sockets Layer), more commonly known now as TLS (Transport Layer Security), is a fundamental technology for securing data exchanged over the internet. SSL/TLS encrypts data between web servers and browsers, ensuring that sensitive information such as passwords, credit card details, and personal data remain secure from eavesdropping and tampering.

I remember vividly in the early 2010s how obtaining an SSL certificate was a costly and cumbersome process, often reserved for large organizations and businesses with the resources to afford them.

Life Before Let’s Encrypt

Back then, securing a website via SSL was optional. You would develop a website for a client and give them the option to secure their website or not. Most of the time, if the website was just informational, the client would decline. Even for those that were transactional, they would redirect their users to other secure websites to handle the transactions for them rather than go through the complexity of acquiring an SSL certificate.

Obtaining a certificate back then could cost anywhere from $50 to several hundred dollars annually, depending on the level of validation and warranty offered. This cost was prohibitive for small businesses, personal websites, and non-profit organizations.

Additionally, the manual steps required to generate a certificate signing request (CSR), submit it to a certificate authority (CA), and install the certificate on a server were often seen as a barrier for those without technical expertise. As a result, many websites, particularly smaller ones, operated without SSL, leaving user data vulnerable to interception and manipulation.

Introduction of Let’s Encrypt

Founded in 2014 by the Internet Security Research Group (ISRG), Let’s Encrypt was created with a mission to make SSL certificates free and easy to install. By offering free SSL certificates, Let’s Encrypt aimed to promote a more secure and privacy-respecting web. Unlike traditional CAs, Let’s Encrypt operates as a non-profit entity, relying on the support of sponsors and donations to cover its operational costs. The goal was clear: eliminate financial and technical barriers to SSL adoption and encourage a global shift towards HTTPS.

Impact on SSL Adoption and Web Security

The impact of Let’s Encrypt on SSL adoption has been nothing short of transformative. Since its launch, there has been a dramatic increase in the number of websites using HTTPS. This surge in adoption has had several positive effects:

  • Improved Security: By making SSL more accessible, Let’s Encrypt has contributed to a significant reduction in the amount of unencrypted web traffic, enhancing the overall security of the internet.

  • Enhanced User Trust: HTTPS is not just about encryption; it also signals to users that a website is trustworthy. This has led to increased user trust and confidence, particularly in e-commerce and online services.

  • SEO Benefits: Major search engines like Google began favoring HTTPS websites in their rankings, further incentivizing website owners to adopt SSL.

  • “HTTPS by Default” Mentality: With Let’s Encrypt lowering the barrier to entry, HTTPS has become the norm rather than the exception. Web developers and website owners increasingly see HTTPS as a default requirement rather than an optional feature.

Challenges and Criticisms

Despite its many successes, Let’s Encrypt has faced its share of challenges and criticisms:

  • Domain Validation and Misuse: As a domain-validated (DV) certificate authority, Let’s Encrypt only verifies domain ownership, not the identity of the website owner. This has led to instances where malicious actors have obtained SSL certificates for phishing sites, relying on users’ trust in the HTTPS padlock symbol.

  • Renewal and Outage Management: While Let’s Encrypt’s automated renewal process is a significant improvement over manual renewals, it has occasionally led to complications during outages or when automation scripts fail.

Let’s Encrypt has addressed these concerns by improving validation processes and collaborating with the cybersecurity community to mitigate abuse.

Wildcard Certificates

When Let’s Encrypt was initially introduced, you could only secure single domains/subdomains. After 2018, Let’s Encrypt began offering wildcard certificates to meet the needs of its users better, while still maintaining high-security standards through the ACME protocol for automation and renewal.

While this was widely applauded, there was the criticism of the inability to automatically renew wildcard certificates. I personally ran into an issue where we wanted to generate a wildcard certificate for a multitenant application. The process went well until we discovered that we would have to manually renew the certificate every 90 days. I found out later that this was a policy decision by Let’s Encrypt due to the fact that certificate issuance and renewals involve creating specific DNS records to prove domain ownership.

Let’s Encrypt’s policy of not automatically renewing wildcard certificates is primarily a security measure designed to ensure greater control and oversight of wildcard certificate usage. However, it can also be seen as a criticism because it increases the administrative effort required for managing these certificates, potentially leading to expired certificates and associated service disruptions

The Future of SSL and Let’s Encrypt

As we look to the future, the role of Let’s Encrypt in web security remains vital. While SSL/TLS encryption is a crucial component of web security, it is just one piece of a larger puzzle.

Let’s Encrypt continues to innovate, with ongoing improvements to the ACME protocol and initiatives aimed at further simplifying and automating web security. The future will likely see Let’s Encrypt expanding its offerings to address emerging security challenges and contribute to a safer internet for all.