10 Years of Let's Encrypt
Pre–Let’s Encrypt TLS Was Painful and Expensive
- Commenters recall paying hundreds of dollars per hostname to legacy CAs (Verisign, Thawte), faxing paperwork, and using “SSL accelerators.”
- Free options like StartSSL/WoSign existed but were clunky, had arbitrary limits, and ended badly when trust was revoked.
- Many sites simply stayed on HTTP, or used self‑signed certs and clicked through warnings.
Normalization of HTTPS and Operational Automation
- Let’s Encrypt is widely credited with making it “absurd” not to have TLS and turning HTTPS into the baseline for any site.
- ACME and tooling (certbot, Caddy, built‑in webserver support) turned cert management from manual CSR/renewal drudgery into a mostly one‑time setup.
- Hobbyists, tiny orgs, and indie devs emphasize that without free, automated certs they simply wouldn’t bother with HTTPS for blogs, Nextcloud, or side projects.
Concerns About Centralization, Policy Pressure, and Small Sites
- Several worry that browsers now gate many HTML5 features on HTTPS, effectively requiring CA “blessing” even for static, low‑value sites.
- Some see this as browser vendors and “beancounters” offloading security work onto everyone, including non‑technical volunteers and tiny groups who struggle with HTTPS and hosting migrations.
- There is unease about one nonprofit CA becoming critical infrastructure and being US‑based, with hypothetical worries about future political or censorship pressure. Calls for more free CAs and diversification appear.
Shorter Lifetimes and Operational Trade‑offs
- The move from 90‑day to 45‑day certs is debated:
- Pro: forces automation, mitigates broken revocation, and reduces damage from key compromise; prevents large enterprises from building multi‑month manual renewal bureaucracies.
- Con: increases risk if Let’s Encrypt has outages, makes manual or semi‑manual workflows (some FTPS vendors, wildcard DNS flows) more painful.
Identity, EV/OV, and Phishing
- Some complain that Let’s Encrypt is “cheap” or enables phishing/fake shops because anyone can get DV.
- Others respond that WebPKI’s real job is domain control and transport security, not real‑world entity authentication; EV/OV largely failed to provide reliable identity and gave no measurable user benefit.
- There’s agreement that users rarely inspect issuers, and that conflating the lock icon with “authentic business” was always misleading.
Certificate Transparency and Attack Surface
- CT logs are praised for visibility but also blamed for instantly exposing new hostnames and triggering automated scans and login attempts.
- Some avoid leaking internal hostnames by using wildcards or private CAs for non‑public services.
Hosting Ecosystem, Devices, and Edge Cases
- Some shared hosts allegedly block external certs to sell overpriced ones; others integrate Let’s Encrypt directly.
- Internal devices, routers, and IoT (ESP8266, printers, switches) remain awkward: limited TLS support, hard-to-install custom roots, and difficulty using ACME without public DNS.
Overall Sentiment and Future Wishes
- Overwhelming gratitude: many call Let’s Encrypt one of the best things to happen to Internet security in the last decade and donate regularly.
- Desired next steps include: more resilient, globally distributed issuance; alternatives/peers to Let’s Encrypt; better stories for S/MIME, code signing, and local/IoT certs; and possibly more DNS‑based or DANE-like models if browser and DNS ecosystems ever align.