Introduction to Let's Encrypt

Let's Encrypt is a free, automated, and open certificate authority (CA), run for the public's benefit.

I'm a Security Engineer at Mozilla, and in this presentation I discuss the past and future of SSL/TLS and HTTPS on the internet, and how Let's Encrypt is promising to make the internet a safer place for everyone.

discussion today. Today I'm going to be talking about
Let's encrypt. my name is April King and

I'm in information security engineer
here at mozilla and I' just like to say

before we get this presentation really
going, just a brief disclaimer so you

know there are many many adjectives that
have been used to describe me and but

these adjectives do not include the terms
classy or circumspect or anything along

those lines but because this
presentation is apparently being

recorded

I'm gonna try to be at least a little
bit of both of those as best I can but

no promises. alright, so speaking of adjectives,
there a number of other adjectives that

do work for me and these include both
old and curmudgeonly because I am both old

and curmudgeonly I like to begin all
my presentations with a little history

lesson to make everybody in the audience
suffer along with me so I'm gonna take you

all back and the year is 1995 and in
1995 there's a new company up-and-coming

by the name of Netscape Communications
and this up-and-coming company releases

a web browser and this particular web
browser is actually really special

because for the first time in history

includes support for protocol called
SHTTP which later became known as HTTPS

and this is a really big deal because
for the first time in history the

average human being

had access to secure, private
communications over an untrusted network

now I mean sure there was encryption
before 1995 obviously like you know if

you are very technically inclined you
might have had access to a tool called a

PGP and you can use this tool to
generate keys and send them to your

friends and you guys can send messages
back and forth but it certainly wasn't

very easy you know and if you were a
huge corporation with piles of money you

know you can pay IBM to come out and IBM
would set up a nice system for you and

you could have encrypted communications
over between your data centers and whatnot

and of course if you are like a
government then you had your own

army of mathematicians and cryptographers
to do all this work for you but you

know if you were just the average human
being you didn't have access to this this is

a really big deal now you're probably
thinking to yourself so 1995 obviously

you're good at arithmetic 1995 that's
twenty one years ago so given that it's

been 21 years we must be doing an
amazing job, right? everything on the

internet must use HTTPS, right? 21 years!
but it turns out that, actually, we're kind of

doing a lousy job. see, 21 years later
we have found through our data from

people who opt in to share their
information with Mozilla that only about

43% of initial page requests are done
over HTTPS and in fact only 65 percent

of those follow-ups requests are done over
HTTPS now be things like JavaScript

files and images and things like that
and that's pretty terrible because you

know without HTTPs, without secure
communications you're missing out on a

whole lot of things for example without
HTTPS you don't know you don't have

confidentiality so you don't know if
somebody is monitoring your

communications watching what you're
doing so if you sent a

credit card number or social security
number over the internet you don't know

if somebody is just sitting there and
listening and just like you know writing it

down I'm sure on their little scratch pads, you know?
you also don't know that you're talking to

who you think you are talking to you
know without HTTPS you can take

www.mozilla.org into your web browser and
you might get a site and it might look

like Mozilla dot org and you may click
to download Firefox and you might get a

file claims to be Firefox but because he
didn't use https you don't actually know

if that's the case that could have been
someone impersonating our website and

offering you up a Trojan version of
Firefox and what's more you also don't

have integrity, see, without HTTPs you
don't know if somebody is injecting

content in the things you are requesting
or sending so we see this a lot

especially with our providers all around
the world if you're here in the USA

might be familiar with the verizon
supercookie

I think a number of other companies are
doing this where if you are browsing

from your mobile phone

all of your outgoing request would
contain a unique identifier identifying

who you were even, you know if you didn't opt into
this you just got you know you just got

identified it to your service providers
and strategic advertising partners and

we also see this a lot particularly in
Asia we see a lot of content injections

that put ads in the pages you are trying
to browse or those ads that were in the

page you're trying to get replaced with
different ads and that's pretty big deal

because you know if your are me and you
really like reddit.com and those

advertisements that they're offering to
replace with some other advertisements

than the sites that I really want to
continue to survive are not getting the

money from offering these advertisements
now it's been 21 years and you're

listening to me

April King a security engineer and
Mozilla a company that makes a web

browser so I'm sure in your head you're
thinking April why haven't you

personally fixed this problem why
haven't you fixed it, Apirl? Why are only 43%

of requests done to websites done over
HTTPS and the answer if anybody is

curious is that money people yes indeed
in fact if you want to have a secure

website on the internet if you want to
use https you need to have a digital

certificate and a digital certificate
like a file kinda like a driver's

license it identifies you to the people
who are visiting your website and it

allows them to verify mathematically
cryptographically that they are in fact

talking to who they think they are now
these certificates are issued by about

2,000 or so different entities around
the world and these energies are called

certificate authorities and the
certificate authorities want to make

money now money is pretty great if you
were to come up to me and be like April

would you like some more money I would
be like why yes I would I would indeed

enjoy some more money and I don't
blame these certificate authorities they

also want more money

but the problem with money is that when
things cost money things tend to be like

difficult painful lousy experiences
see, you know, because when they're

lousy and painful you kinda get locked in
but it's a pain that you know right so

traditionally right if you want a
certificate

you know you type some arcane
commands into your computer and you get a

private key and then you type another
command and it generates a file called a

Certificate Signing Request and then you
take that file and you might copy it and

go to your certificate authority and
paste it in some web forms and then you

submit it and then a bunch of back and forth
they verify you are who you say you are

and then they give you a file and
you download that file and upload to your website

it's a pain in the but it really sucks I hate
doing it I do this professionally for a

living I get paid to do it I still hate
doing it while I have some good news to

everybody here in the audience watching
that is there's a new certificate

authority in town and it's called Let's
Encrypt and it's amazing and I'm gonna

tell you why it is in fact super duper
amazing now I'm not going to bury the

lead I'm gonna to be straight up and honest with
everybody watching Let's Encrypt is a

free certificate authority totally free
and what they mean is that regardless of

your ability to pay you can get a
digital certificate if you are well

known multi billionaire Bill Gates and
you want a free digital certificates why

I say to you good sir you may have a
free digital certificate or you know if

you're an eight-year-old girl setting up
your first website for the first time

will you young lady you also can get a
digital certificate it doesn't matter where

you are or how much money you have you
can get a digital certificate that's a

really big deal because you know when things
cost money there's a whole lot of

restrictions around it right there's
taxes and there's international law

and it's really really complicated you
know if you live in a place where you

don't necessarily have a local certificate
authority or you don't have money then

you know not be able to get a free
certificate can really make it so you

just can't have a secure website but
with Let's Encrypt you can have a free

certificate and a secure website

so not only is Let's Encrypt free but it's also
automated now I'll talk a little bit more about

this more later and how this all works
but see most of the difficulty in requesting

and receiving a certificate is in the
process of verifying that you are who

you say you are right i mean you don't
want to be able to issue a certificate to just

anybody who comes along for any website but
Let's Encrypts uses a protocol

that's in the process of being
standardized to just do all this

automatically for you it really does
appears like magic

you just automatically get a certificate if you want
to revoke you certificate it's just like magic

your certificate is revoked and if you want to
renew it it's like magic again you just

get a brand new certificate it's pretty
cool so not only is Let's Encrypt free and automated

but it's also a transparent what that
means is that every certificate the Let's Encrypt

issues is logged in a system
called the certificate transparency

system meaning that there's no way for
Let's Encrypt to like issue certificates

for sites it wasn't authorized for if
we did it would show up in the system if

you have a site and you want to be
monitoring you know any authority has

issued a certificate for you and you
don't requested you can look at these

lives and be sure that lets encrypt
didn't issue a search for your site and

not only that but if a cert does appear
in the wild from what some crepes and it

isn't there then you know immediately
that they're not being honest but they

are being honest they're amazing and
that's why they're using certificate

transparency alright so they're also an
open certificate authority see

everything about let's encrypt that they
do is open source that's amazing see

that includes not just the the the
software runs certificate authority and

issues a certificate but it also
includes after that you can put on your

computer or your server to get a
certificate and it's even this very

presentation as amazing as it is is also
open source you can download it from I

get hungry power

requests are happily ignore it it's
great alright but such a totally I'll

totally take a look

in addition to all those things but is a
cooperative certificate authorities see

couple years ago and Mozilla went out
and decided that this is the real the

need to be needed to be met on the
internet you know we found some like

really great partners to work with us
including Akamai Cisco and the eff and I

thought this is an amazing idea and you
know they helped build the software that

issued the search and receive the search
and it was really great and as it went

timeline on many other organizations
said oh my gosh this is a great idea

this is making the internet a way better
place and we want to help so they've

joined us and become sponsors as well
which means LSU campus in a stable

supply of middle-income to ensure that
it can be around for many many many

years into the future now because it's
so cooperative and the softer is so open

and the protocol that uses is also open
a lot of people have participated in

this whole process run with the crypt
cell talk a little bit about the process

with which you can get a certificate
through lesson crepes now here's the

real question that all C A strugglers
rate this is the question behind request

and that is if I ask for certificate for
a website I say dear unnamed certificate

authority because I am being recorded
near unnamed certificate authority I

would like a certificate for amazon.com
I am a fucking but I'm also definitely

the owner of amazon.com now that's
significant authority to look at me and

say April you looked super shady I don't
think you actually own amazon.com items

and now and that's what they're supposed
to do they're not supposed to issue me

one of those certificates because if I
had that certificate I could be

amazon.com even if people did use https
now historically there's been a number

of different ways that we have verified
that somebody actually own the domain

that they claim they own for example you
might ask them to set up a DNS record

right that you know is a branch off of
their domain specific thing with a

special record inside it

and you can reasonably say that some
controls DNS then they also control the

website right i mean if I control the
dinosaur amazon.com explain it any

server I wanted to you that's one way or
another way as they might say we want

you to place this particular file on a
particular spot on your web server and

then once it's there you can let us know
and we'll go out and check to see if

that fails there and if you have the
ability to place this file on amazon.com

web server and the specific location
then you probably actually do own

amazon.com and lastly underway as they
might say you know spin a web server

that uses GPS with a you know what they
saw us answered that will give to you

and then we'll go out and we'll connect
you right and if you can do that if you

can listen on port 443 on amazon.com
then you also probably on amazon.com is

a historically been kind of a three
primary methods that we've done this but

what's encrypt it kind of ties to
automate all that away and it does that

through and center call acne and acne
stands for the automated automatic

certificate management environment and
it's a protocol it's in the process of

being standardized by the IETF that
hopefully in the future

every CA every certificate authority can
use now the idea of having a

standardized protocol is that you can
build toting around it right now if you

make a web server right if you make a
patchy your engine acts or something

like that then you can build support for
this work all right into your web server

if you were trying to set up a doctor
container you can set it up so that it

goes out and it requests to do these do
this protocol because it exists

we've actually seen incredible adoption
across the industry and in fact an

increasing number of like web hosting
big web hosts relic DreamHost not

combine WordPress and the like I have a
Dr less equipped to add support for a

CBS across thousands of domains that
never had as two Bs before and they can

do that because of letting

apps for their we're seeing tools for
pretty much everything with you you can

think of that support the acne protocol
to help you automate the process of

requesting certificates and a number of
web servers have begun the process of

adding support for Mitac mio or other
modules rate that support the crack me

so that like in the future you know you
can just put the URL for the acne thing

you know your web service configuration
and regardless of certificate authority

right you can just go out and get a
certificate when it starts up in fact

I'm gonna show you are a demo of that
and by a guy named Matt Holt and battled

writes a web server called caddy is the
primary author of it and he built in

support into his web server for lunch
and then and acne and he recorded a

video of himself

setting up a web server getting a
certificate he put it up on YouTube for

us to for the whole world to see we
don't ask him to write the code we

didn't ask you to put the video up and
he did it and I'm gonna show you all

what that looks like alright so here we
go I

here we are he is heading the file that
contains the host name of his server

that's it is gonna start of his web
server setup is going out to link up to

get a certificate and done it has a
digital certificates now he's just gonna

go to his website is going to see it is
unfortunately he's using ground but you

know what this works in Firefox it works
in edge works in Safari

Christopher gets to you and there you go
he's got a digital certificate is let's

say works at HTTPS and that was so easy
wasn't it was so easy you compared to

all the copy and paste in incomes
cryptic OpenSSL commands you take in the

past

pretty great so lets the crib has been
around available to the public for about

three months so how well has left
encrypted been doing since it started a

few months ago and the answer is amazing
and in fact been over there is only one

over one million on expired certificates
issued by less equipped covering over

two and a half million domain names and
the reason why those numbers are not the

same as that advocating cover like you
know website aa.com and www.sedar.com

and so on and so forth and the coolest
thing about all of that is that the vast

majority of those sites have never had
sushi ps2 for an effect of those two

point six or whatever

2.6 million domains only about a hundred
and sixty-five thousand of them have

ever had a stiffer get it from a
different certificate authority that's

incredible

we're actually making a huge difference
on the Internet tons of states that

never had a chance or couldn't afford a
GPS before now have HTTPS and in fact

you remember that I turn that sad but
you know delicious looking pipes are at

the beginning of the presentation of it
said only 43% of requested under a CPS

well before let the crib started three
months ago that number was only 40 per

sentence so in just a few months we have
moved the needle 3% on the internet

that's huge I know it only sounds like a
small percentage point three percent is

a ton

of traffic on the internet that's
incredible now how big is letting crips

already the fourth largest issuer
certificates in the world behind komodo

some Mexican Go Daddy pretty cool but
this is only the beginning seeing

obviously I work at Mozilla and I love
the web and so I wanna see every website

using HTTPS and that's a great goal but
you know the Internet has a lot more

stuff on it than just web servers right
has mail servers has IRC servers and

many many many other protocols we want
to secure all of those as well so I'm

really looking forward to a day and I
think we're definitely moving there

thanks to let some crepes and and acne
and all of the community support that

has been built up around this where
everything that we do on the Internet is

to cure and its privates and you know
that when you are on the internet and

you were trying to talk to somebody that
your conversation is secure and private

so as this presentation has been
recorded in kind of talking to the whole

world I guess I have to tell everybody
hello world

crafts

have any questions that I can answer yes
let's encrypt is not too wild card certs

and the reason for that is line is that
while there's can kind of read you a

number of security issues and two is
that it's just so easy to get a search

for whatever name you need with what's
incorrect like there's no real need to

get allows for certain you just start
the server and never got an answer for

you just run the command and you you
have a search that doesn't support while

cart sir another thing that people often
ask me can I get like a four I guess

three-year long certificate with I think
reps and you cannot do that either one

of the issues such as they get their
certificates for about three months and

because they only have three months it
tends to lead to a world where the sort

of stuff this certificate requesting and
web site configuration such as automated

right

expire every three months you can't deal
with the process we're like a beast rate

of piece of code that monitors all of
your sites and goes out every day and

thanks to expire inserts and then you go
and upload new ones because you never be

able to make it work so it forces people
to automate the issuance of certificates

under web server so that like you're
constantly getting new certs and you

know that you know you're constantly
safe under console using the most secure

methods of securing your sites

so the same commanded that same single
command that it takes to issue a

certificate is basically the exact same
to come and you use to get a brand new

so I know just how I got a process that
runs every couple months I don't

recommend it is everybody thinks the
first of the month is the best day but

they just have a process that runs every
month or two that just goes out and just

get really really is the question is why
would anyone so I mean like trying to

take over the world like their you know
their goal is to make certificates

available to everybody but you know
these use cases that what's encrypt

meets are not like every possible use
case like you know there's a lot of

hardware on the internets alot of
devices that you just can't do not

getting updates you can apply new
certificates to them but you you can

write new car from there's nothing ever
be support for actually built into them

and those cases like having the option
to be able to get a three-year long

certificate and go on an insult one can
be sure that it's fine for three years

is great and there's a number of use
cases that traditional meat and doesn't

and that's great you know but for the
average person who want to certificates

for their website he now has never been
able to get on the floor let script is

is the perfect solution for getting that
certificate yes

their features that need to be built to
you know kind of help support supporting

chats and email and other things like
that and the answer is yes so I

currently at what secret is a little bit
women didn't like how might actually

works as they either like other places
filing your webserver likes you don't

have to like restart it or it starts at
the server the lessons on port 443 and

you know what script will talk to that
system to verify the domain ownership

but for a lot of sense that's not
possible right I give you just have a

mail server you're not going to want to
also install a web server or something

on there to do that and so there is work
on possibly identify another part that

could be used as work on just the whole
Turner on all of the other tools that

people use now it's not too difficult in
my experience to make it work with those

things like the commanders lunch menu
can run as stand-alone right it doesn't

work in connection with any web servers
and all it does is it starts up and put

the stick it on your file system for
your domain so you know you just run

this one command in your mail server for
email download still adore it goes out

and gets a formality and all you have to
do is just you know that automated

update every couple months and you put
your mail server at that certificate

file that just get put on your file
system and just have it reload every

couple months as well and then you're
really too hard to get it working with

non rebbe things but certainly be a lot
better yes

why funds instead of one week for
exploration or one year or whatever why

I'm the answers they like two months is
kind of like a reasonable compromise so

one of the things that really is
terrible about issue BS on the internets

is that a certificate is that it's
really hard to revoke a significant one

ambien by revoking a certificate is
saying that the certificate if you see

it in the wild is no longer valid for my
websites right or my mail server or

whatever and there is a historically
been a number of different protocols to

make this work but they've also they're
all terrible they're all really really

bad and so and it's getting a little
better but still the process of

revocation is is kind of painful and so
when you have a short clip certificate

that one that kind of last for only a
few months or a couple weeks you kind of

get revocation for free right when I
mean by that is that if somebody breaks

in your system and they still a private
keys and is still your certificates

right that's difficult only to be valid
for very short period of time so well

that is super bad right it will expire
very quickly and those kids will no

longer be valid if that's what you get
with no longer be valid and now as to

why it is three months and not like a
week which would be better I mean if you

write if you have an automated you could
have to get a new search every night and

the answer is like for people's comfort
right if if people are used to

requesting a certificate the last 42
years right and I wasn't using an

erroneous to forget that last for a week
that people get really nervous when I

build system breaks right and for some
reason I just can't fix it in a week

right then you know you're gonna go bad
right so there's no reason

why it can't be sure and I think I think
in the future there might be the ability

to request sugar lips certificates but
like three weeks as art I few months is

considering I kind of like a reasonable
compromise between security and

usability yes I said the question was
what is the process for look like for

the answer is really really really good
so if you use any kind of modern browser

then you will have support for letting
crepes and the way they obviously you

think your selfless let's encrypt it was
called the ritz certificate authority to

issue certificates rights you know that
put into all these browsers behind you

go back and fix like you know how do you
go back and fix Firefox 38 right we

can't like to build an old version of
Firefox and goods less equipped and the

answer is that existing root certificate
authorities will sign with the crib

certificate authority like exists that
have been in browsers for a long time

will sign that 30 so that it shut the
chain a trust that is used to verify

saved goes up to something that has been
around for a long time so that means

that if you have a certain should be
less incorporate now it should work with

pretty much anything made in the last
quite awhile works on all the major web

browsers that works in Java works in
pretty much everything you would expect

I believe support for were very old
versions of Internet Explorer is coming

very soon if it hasn't already but by
and large if you have a site on the

internet you can be pretty comfortable
in fact that you will be able to connect

you just fine

yes one more question the question is is
there anything that prevents you from

your questions for its more frequently
in the answer is no you can request more

frequently the only downside is that you
know what the craft has like a certain

amount of economic issues so many third
so quickly right so I eyewitness I

recommend whether crept to be used for
like you're building a container right

and just you know during your build
process server container and goes on

request a certain does all these tests
like I would recommend using my back

because there is there are those rate
limiting the African and Jamaican get

new certs but you know if you want to
request a third every month or so

there's nothing stopping you from doing
that I thank you all for coming I really

appreciate it