Let's Encrypt
Let’s Encrypt: the free certificate authority that secured the web
Let’s Encrypt is a project that has played a fundamental role in securing the internet since its emergence. It offers free Transport Layer Security (TLS) certificates, allowing websites to switch from unencrypted HTTP to encrypted HTTPS connections. These certificates are essential for protecting data transmission between users and servers, and ensure that communication cannot be intercepted or manipulated by third parties. Let’s Encrypt uses automation and open standards to make obtaining, installing, and renewing certificates simple and accessible for everyone, from small bloggers to large companies.
The project is an initiative of the Internet Security Research Group (ISRG), a non-profit organization founded on May 24, 2013. ISRG is responsible for the management and operational execution of Let’s Encrypt. The organization was founded with the goal of improving the security of the internet by making it easier to deploy encrypted connections. The idea for Let’s Encrypt originated as early as 2012, when a group of experts from the technology and privacy world recognized the problem that TLS certificates were often expensive, complex, and difficult to manage. This hindered the broad adoption of HTTPS, despite the clear benefits for privacy and security.
The founders of the project were Josh Aas and Eric Rescorla of Mozilla, Peter Eckersley of the Electronic Frontier Foundation (EFF), and J. Alex Halderman of the University of Michigan. These people worked together to develop a system that could issue certificates automatically and for free, based on open technology and with a strong focus on privacy and accessibility. Their shared vision was to create an internet where encryption is the standard, rather than a luxury for those who could afford it.
The public debut of Let’s Encrypt took place on November 18, 2014, when the project was formally announced. This was an important milestone, because it indicated that the technology was ready for broader testing phases and that the key partners — including browsers and certificate trust chains — were taking the initiative seriously. The first step in the actual issuance of certificates followed on September 14, 2015, when Let’s Encrypt issued its very first certificate. This marked the beginning of the practical application of the system.
A crucial development followed on October 19, 2015, when Let’s Encrypt officially became publicly trusted. This means that ISRG's root certificates were included in the trust stores of major browsers and operating systems, such as Firefox, Chrome, and Safari. Without this trust relationship, browsers would show warnings when visiting HTTPS sites with Let’s Encrypt certificates, which would ruin the user experience. The trusted status made it possible for certificates from Let’s Encrypt to be accepted without additional settings or warnings.
On December 3, 2015, Let’s Encrypt was declared generally available. From that moment on, anyone worldwide could request free certificates through the system, without waiting lists or restrictions. This was the starting signal for an explosive growth in the use of HTTPS. Before Let’s Encrypt existed, the number of encrypted websites was limited by costs, technical barriers, and administrative hassle. After the launch of Let’s Encrypt, that changed radically. Within a few years, the percentage of HTTPS usage on the web rose from a fraction to over 90%, and Let’s Encrypt played a central role in that.
One of the core innovations of Let’s Encrypt is the use of the ACME protocol (Automated Certificate Management Environment). This protocol places automation at the center of certificate management. Instead of an administrator having to manually request, sign, and install a certificate, a server can automatically communicate with Let’s Encrypt to obtain a certificate. This happens via a client such as certbot, which is released by the EFF, or via integrated solutions such as cert-manager in Kubernetes environments.
In modern cloud architectures, such as Kubernetes, automation is essential. A Kubernetes cluster consists of control planes (with components such as the API server, etcd, scheduler, and controller manager) and worker nodes (with kubelet, kube-proxy, and a container runtime such as containerd). When applications are exposed via an Ingress controller — such as Nginx Ingress or Traefik — it is crucial that they can handle traffic via HTTPS. This is where cert-manager comes in: it integrates with Let’s Encrypt via the ACME protocol and ensures that TLS certificates are automatically requested and renewed for every Ingress rule that requires HTTPS. This happens transparently, without an administrator having to intervene daily.
However, Let’s Encrypt certificates are temporary: they are only valid for 90 days. This is a deliberate choice to promote security. Short-lived certificates limit the damage if a certificate were to fall into the wrong hands, and force organizations to automate. Anyone who manages certificates manually runs the risk of a certificate expiring — with the result that the website is no longer accessible via HTTPS. Through the short lifespan and the emphasis on automation, Let’s Encrypt promotes good security practices on a large scale.
The impact of Let’s Encrypt is enormous. It has drastically lowered the barrier to HTTPS and has contributed to a safer internet. Nowadays it is unthinkable that a serious website would run without HTTPS. Search engines such as Google penalize unencrypted sites in their ranking, and browsers show explicit warnings when entering sensitive data on HTTP pages. Let’s Encrypt has made this transition possible by offering a reliable, free, and automated solution.
The project is also an example of successful collaboration between non-profits, technological institutions, and volunteers. ISRG works closely with partners such as Mozilla, Cisco, Google, and the Linux Foundation, which contribute financially and technically to the continued existence of the CA. The open source nature of the software and the protocol ensures transparency and trust in the system.
Unfortunately, on September 2, 2022, the community lost one of the important figures behind the project: Peter Eckersley passed away. As co-founder and long-time technical leader at the EFF, he was a passionate advocate for privacy and online freedom. His contribution to Let’s Encrypt and to the broader digital rights movement remains of lasting value.
Today, Let’s Encrypt remains an indispensable pillar of the modern web. It runs in the background of millions of websites, often unseen but essential. By combining open technology, automation, and a non-profit model, the project has shown that security on the internet can be accessible to everyone — not only to those with a budget or expertise. It is a powerful example of how open source and community-driven technology can make the internet better for everyone.