Let’s Encrypt: The Day HTTPS Went Free

“Free as in Certs”: How Let’s Encrypt Made HTTPS the Default

For years, small sites treated HTTPS as optional—expensive certificates, manual renewals, and mysterious CSR rituals kept it rare. Then Let’s Encrypt launched public beta in 2015 and scaled in 2016 with the ACME protocol: automated, free TLS certificates on cron‑like schedules. Within a few years, web telemetry flipped: more than half of page loads arrived over HTTPS, then most (see Let’s Encrypt, Transport Layer Security). 🔐

Claim: Let’s Encrypt was a policy + tooling turning point. It made the secure choice the easy choice—and then the only acceptable one.

Before: The Pain of Certificates

Admins wrangled certificate signing requests, paid per domain, copied PEMs, and scheduled calendar reminders to avoid outages. Misconfigurations birthed mixed content, scary browser warnings, and lost trust.

Economic skew: Big sites could afford security teams; small publishers could not. The web’s privacy was uneven.

Enter ACME and Automation (2015–2016)

Let’s Encrypt, backed by ISRG, Mozilla, EFF, and partners, shipped ACME—a protocol where clients (e.g., Certbot) prove domain control via HTTP‑01 files or DNS‑01 records, then fetch short‑lived certs. Auto‑renewal solved the human factor. Browsers nudged with “Not Secure” labels on HTTP, flipping incentives.

Timeline

• 2015: Public beta; early adopters script renewals.
• 2016–2018: Major hosts and CDNs integrate one‑click HTTPS.
• 2018+: HSTS preload, TLS 1.3, certificate transparency logs mature.

Impact: Privacy, Integrity, and New UX

With HTTPS default, eavesdroppers lose the easy path; integrity improves (no ISP injection). SEO signals rewarded HTTPS; users acclimated to padlocks and neutral warnings. The ecosystem normalized CT logs and OCSP stapling; outages became rarer because renewals were predictable.

UX note: Security UI should be quiet when safe and loud when unsafe. Let’s Encrypt helped browsers make that swap without bankrupting publishers.

Futures: Client Certs, Post‑Quantum, and Beyond

Automation will extend to client certificates for mutual TLS in consumer apps; post‑quantum algorithms will ride the same pipelines. The deeper lesson stands: make good behavior easy. Security becomes a product of defaults.