HTTPS & Let's Encrypt

At the tail end of last year (2015), the Linux Foundation announced the public beta release of a new Certificate Authority (CA) under the name "Let's Encrypt". The main thing that differentiates this CA from others is that it is free. At the beginning of the year I dove right in & setup certificates for this site and my wedding website. The process was a bit clunky to begin with, but by the time it came to test the renewal approximately 80 days later (which didn't go smoothly, what does first time around?), the Let's Encrypt team had significantly improved the process of renewals. Therefore to my delight any site I now setup will have an automatically renewing SSL certificate.

You may be asking why is this so important? Why is a free CA something to write about? Most internet users know that they should check for the green padlock when logging into a secure site (e.g. banking, e-commerce), this means that the site has a SSL certificate so any information you send to their servers is encrypted and no one should be able to read that information except the intended recipients. Having HTTPS is so important these days that Google even takes it into consideration when ranking search results, it should be done by default. However SSL certificates cost hundreds if not thousands a year, the thousands is for when the company name is shown in the address bar of your browser (see below for an example). The fact that these normally cost so much puts them out of reach of individuals looking to secure their website.

HTTPS in Browser Bar

Therefore the work that Let's Encrypt is doing in bringing an automated free solution is so important for the web of tomorrow and truly allows HTTPS to be the default when setting up a website. This is especially true when service providers are integrating the Let's Encrypt solution into their platforms, for example Netlify, and Shopify have already done this.

If you have your own site and are looking to get https added, check out the Let's Encrypt documentation here or send this information to your service provider asking them when they intend to offer https for free.