Let's Encrypt and HTTPS Everywhere: How Free Certificates Won

In the early 2010s, most websites still used plain HTTP, and getting an SSL certificate meant paying a certificate authority and following a manual process. Today, the majority of page loads in major browsers use HTTPS, and certificates are free and issued automatically. The change was driven by a few events and, above all, by one project: Let's Encrypt.

A short history of web encryption

Netscape created SSL (Secure Sockets Layer) in the mid-1990s so that customers could send credit card numbers over the web. SSL 2.0 was released in 1995, and SSL 3.0 in 1996. The Internet Engineering Task Force standardised the protocol under the new name TLS (Transport Layer Security) in 1999. Over time, weaknesses were found in the older versions, and they were retired. Modern sites use TLS 1.2 or 1.3, even though people still say SSL.

For many years, HTTPS was used for payment pages and logins. Most other pages were left unencrypted because certificates cost money, setup was complicated, and some thought that content which was not secret did not need protection.

Why that view changed

• Public Wi-Fi attacks. Tools in 2010, such as the Firesheep extension, showed how easily someone on the same network could hijack another user's logged-in session on a site that used HTTPS only for the login page.
• Surveillance revelations. In 2013, disclosures about mass surveillance made engineers and companies more concerned about protecting traffic in transit.
• Tampering. Unencrypted pages can be altered on the way, for example by networks that insert adverts or malicious code.

The Let's Encrypt project

The certificate authority Let's Encrypt was announced in November 2014. It is run by the Internet Security Research Group (ISRG), a non-profit organisation, and was supported at the start by sponsors including Mozilla, the Electronic Frontier Foundation, Cisco, Akamai and the University of Michigan. Its goal was to make HTTPS the default by offering certificates free of charge, automatically and openly.

It issued its first certificates in 2015, entered public beta in December 2015 and became generally available on 12 April 2016.

How it works

The key technical piece is the ACME protocol (Automatic Certificate Management Environment). A piece of software on your server proves to Let's Encrypt that it controls the domain, usually by placing a specific file on the website or adding a DNS record, and then receives a certificate. The process takes seconds and can be repeated automatically. Certificates have been issued with a 90-day lifetime, which is much shorter than the one to three years of earlier paid certificates. The short lifetime limits the damage if a key is stolen, and it encourages automation, so that renewals happen without human effort.

The effect

Adoption rose quickly. Hosting companies built Let's Encrypt into their control panels, content management systems added HTTPS support, and browsers moved to encourage it. In 2018, Chrome began marking HTTP pages as "Not secure" in the address bar, which gave site owners another reason to switch. Other factors, including Google's statement in 2014 that HTTPS would be a minor ranking signal, helped to speed things up.

Year	Milestone
1995	Netscape releases SSL 2.0
1999	TLS 1.0 standardised
2014	Let's Encrypt announced; Google mentions HTTPS as a ranking signal
2016	Let's Encrypt becomes generally available
2018	Chrome labels HTTP sites as not secure

What HTTPS does and does not do

A certificate encrypts the connection between the visitor and your server and verifies that the visitor reached the right domain. It doesn't prove that a site is trustworthy: criminals use free certificates too, and a padlock only means the connection is encrypted. It also does not protect your site from being hacked. Updates, strong passwords and backups remain necessary.

Checklist after enabling HTTPS

1. Redirect all HTTP URLs to HTTPS.
2. Update internal links, and fix mixed content, where pages load images or scripts over HTTP.
3. Confirm that renewal is automatic.
4. Update your sitemap and analytics settings to the HTTPS address.

Who else offers certificates

Let's Encrypt is not the only certificate authority. Commercial authorities still sell certificates, including extended-validation types that verify the legal identity of an organisation, and some businesses prefer them for that reason or because they need a warranty or a particular support arrangement. Cloudflare and other services can also issue and manage certificates on your behalf when they sit in front of your site. For most websites, however, a free, automatically renewed certificate gives the same encryption strength as a paid one, and the differences are in the extras rather than the cryptography.

The lesson for site owners

Encryption is now a basic expectation. Every Zebra Hosting plan includes free SSL certificates from Let's Encrypt, managed through Plesk, so you don't have to buy or renew anything by hand. You can read how certificates work in practice on the SSL page, and our security page describes the other protections around your site. If you are moving from another host, the migration team can help you set up HTTPS on the new server.