Let's Encrypt is a certificate authority that provides X.509 certificates for Transport Layer Security
(TLS) encryption at no charge. The certificate is valid for 90 days,
during which renewal can take place at anytime. The offer is accompanied
by an automated process designed to overcome manual creation, validation, signing, installation, and renewal of certificates for secure websites.[2][3] It launched on April 12, 2016.[4][5]
The project claims to make encrypted connections to World Wide Web servers ubiquitous.[6] By eliminating payment, web server configuration, validation email management and certificate renewal tasks, it is meant to significantly lower the complexity of setting up and maintaining TLS encryption.[7] On a Linux web server, execution of only two commands is sufficient to set up HTTPS encryption and acquire and install certificates.[8][9]
To that end, a software package was included into the official Debian and Ubuntu software repositories.[10][11] Current initiatives of major browser developers such as Mozilla and Google to deprecate unencrypted HTTP are counting on the availability of Let's Encrypt.[12][13] The project is acknowledged to have the potential to accomplish encrypted connections as the default case for the entire web.[14]
Only domain-validated certificates are being issued, since they can be fully automated. Organization Validation and Extended Validation Certificates are not available.[15]
By being as transparent as possible, they hope to both protect their own trustworthiness and guard against attacks and manipulation attempts. For that purpose they regularly publish transparency reports,[16] publicly log all ACME transactions (e.g. by using Certificate Transparency), and use open standards and free software as much as possible.[8]
Support of ACME v2 and wildcard certificates was added in March 2018.[17]
The Let's Encrypt developers planned to generate an ECDSA root certificate as well later in 2015,[19] which was pushed back to early 2016, and again to 2018.[23][24][25]
The validation processes are run multiple times over separate network paths. Checking DNS entries is provisioned to be done from multiple geographically diverse locations to make DNS spoofing attacks harder to do.
ACME interactions are based on exchanging JSON documents over HTTPS connections.[26] A draft specification is available on GitHub,[27] and a version has been submitted to the Internet Engineering Task Force (IETF) as a proposal for an Internet standard.[28]
The certificate authority consists of a piece of software called Boulder, written in Go, that implements the server side of the ACME protocol. It is published as free software with source code under the terms of version 2 of the Mozilla Public License (MPL).[29] It provides a RESTful API that can be accessed over a TLS-encrypted channel.
An Apache-licensed[30] Python certificate management program called certbot (formerly letsencrypt) gets installed on the client side (the web server of an enrollee). This is used to order the certificate, to conduct the domain validation process, to install the certificate, to configure the HTTPS encryption in the HTTP server, and later to regularly renew the certificate.[8][31] After installation and agreeing to the user license, executing a single command is enough to get a valid certificate installed. Additional options like OCSP stapling or HTTP Strict Transport Security (HSTS) can also be enabled.[26] Automatic setup initially only works with Apache and nginx.
Let's Encrypt issues certificates valid for 90 days. The reason given is that these certificates "limit damage from key compromise and mis-issuance" and encourage automation.[32] The official certbot client and most of the third-party clients allow automation of the certificate renewal.
Several third-party client implementations in several languages were created by the community.[33]
Let's Encrypt was announced publicly on November 18, 2014.[35]
On January 28, 2015, the ACME protocol was officially submitted to the IETF for standardisation.[36] On April 9, 2015, the ISRG and the Linux Foundation declared their collaboration.[18] The root and intermediate certificates were generated in the beginning of June.[22] On June 16, 2015, the final launch schedule for the service was announced, with the first certificate expected to be issued sometime in the week of July 27, 2015, followed by a limited issuance period to test security and scalability. General availability of the service was originally planned to begin sometime in the week of September 14, 2015.[37] On August 7, 2015, the launch schedule was amended to provide more time for ensuring system security and stability, with the first certificate to be issued in the week of September 7, 2015 followed by general availability in the week of November 16, 2015.[38] The cross-signature from IdenTrust is planned to be available when Let's Encrypt opens for the public.[21]
On September 14, 2015, Let's Encrypt issued its first certificate, which was for the domain helloworld
On October 19, 2015, the intermediate certificates became cross-signed by IdenTrust, causing all certificates issued by Let's Encrypt to be trusted by all major browsers.[20]
On November 12, 2015, Let's Encrypt announced that general availability would be pushed back and that the first public beta would commence on December 3, 2015.[40] The public beta ran from December 3, 2015[41] to April 12, 2016.[42]
[*] Of which 3.8 million are unexpired and unrevoked. Their active
certificates cover more than 7 million unique domains, in part due to
support by large hosting companies.
The project claims to make encrypted connections to World Wide Web servers ubiquitous.[6] By eliminating payment, web server configuration, validation email management and certificate renewal tasks, it is meant to significantly lower the complexity of setting up and maintaining TLS encryption.[7] On a Linux web server, execution of only two commands is sufficient to set up HTTPS encryption and acquire and install certificates.[8][9]
To that end, a software package was included into the official Debian and Ubuntu software repositories.[10][11] Current initiatives of major browser developers such as Mozilla and Google to deprecate unencrypted HTTP are counting on the availability of Let's Encrypt.[12][13] The project is acknowledged to have the potential to accomplish encrypted connections as the default case for the entire web.[14]
Only domain-validated certificates are being issued, since they can be fully automated. Organization Validation and Extended Validation Certificates are not available.[15]
By being as transparent as possible, they hope to both protect their own trustworthiness and guard against attacks and manipulation attempts. For that purpose they regularly publish transparency reports,[16] publicly log all ACME transactions (e.g. by using Certificate Transparency), and use open standards and free software as much as possible.[8]
Support of ACME v2 and wildcard certificates was added in March 2018.[17]
Contents
Involved parties
Let's Encrypt is a service provided by the Internet Security Research Group (ISRG), a public benefit organization. Major sponsors are the Electronic Frontier Foundation (EFF), the Mozilla Foundation, OVH, Akamai, and Cisco Systems. Other partners include the certificate authority IdenTrust, the University of Michigan (U-M), the Stanford Law School, the Linux Foundation[18] as well as Stephen Kent from Raytheon/BBN Technologies and Alex Polvi from CoreOS.[8]Technical Advisory Board
- Rich Salz (Akamai Technologies)
- Joe Hildebrand (Mozilla Corporation, formerly Cisco Systems at funding time)
- Jacob Hoffman-Andrews (Electronic Frontier Foundation)
- J. C. Jones (Mozilla Foundation)
- Russ Housley (Independent)
- Ryan Hurst (Google)
- Stephen Kent (Independent)
- Karen O'Donoghue (Internet Society)
Technology
In June 2015, Let's Encrypt announced the generation of their first RSA root certificate, ISRG Root X1.[19] The root certificate was used to sign two intermediate certificates[19], which are also cross-signed by the certificate authority IdenTrust.[20][21] One of the intermediate certificates is used to sign issued certificates, while the other is kept offline as a backup in case of problems with the first intermediate certificate.[19] Because the IdenTrust certificate is preinstalled in major web browsers, Let's Encrypt certificates can normally be validated and are accepted upon installation[22] even before browser vendors include the ISRG root certificate as a trust anchor.The Let's Encrypt developers planned to generate an ECDSA root certificate as well later in 2015,[19] which was pushed back to early 2016, and again to 2018.[23][24][25]
Protocol
The challenge–response protocol used to automate enrolling with this new certificate authority is called Automated Certificate Management Environment (ACME). It involves various requests to the web server on the domain that is covered by the certificate. Based on whether the resulting responses match the expectations, control of the enrollee over the domain is assured (domain validation). In order to do that, the ACME client software sets up a special TLS server on the server system that gets queried by the ACME certificate authority server with special requests using Server Name Indication (Domain Validation using Server Name Indication, DVSNI).The validation processes are run multiple times over separate network paths. Checking DNS entries is provisioned to be done from multiple geographically diverse locations to make DNS spoofing attacks harder to do.
ACME interactions are based on exchanging JSON documents over HTTPS connections.[26] A draft specification is available on GitHub,[27] and a version has been submitted to the Internet Engineering Task Force (IETF) as a proposal for an Internet standard.[28]
Software implementation
Domain selection dialogue
An Apache-licensed[30] Python certificate management program called certbot (formerly letsencrypt) gets installed on the client side (the web server of an enrollee). This is used to order the certificate, to conduct the domain validation process, to install the certificate, to configure the HTTPS encryption in the HTTP server, and later to regularly renew the certificate.[8][31] After installation and agreeing to the user license, executing a single command is enough to get a valid certificate installed. Additional options like OCSP stapling or HTTP Strict Transport Security (HSTS) can also be enabled.[26] Automatic setup initially only works with Apache and nginx.
Let's Encrypt issues certificates valid for 90 days. The reason given is that these certificates "limit damage from key compromise and mis-issuance" and encourage automation.[32] The official certbot client and most of the third-party clients allow automation of the certificate renewal.
Example of a website with Let's Encrypt certificate
History
The Let's Encrypt project was started in 2012 by two Mozilla employees, Josh Aas and Eric Rescorla, together with Peter Eckersley at the Electronic Frontier Foundation and J. Alex Halderman at the University of Michigan. Internet Security Research Group, the company behind Let's Encrypt, was incorporated in May 2013.[34]Let's Encrypt was announced publicly on November 18, 2014.[35]
On January 28, 2015, the ACME protocol was officially submitted to the IETF for standardisation.[36] On April 9, 2015, the ISRG and the Linux Foundation declared their collaboration.[18] The root and intermediate certificates were generated in the beginning of June.[22] On June 16, 2015, the final launch schedule for the service was announced, with the first certificate expected to be issued sometime in the week of July 27, 2015, followed by a limited issuance period to test security and scalability. General availability of the service was originally planned to begin sometime in the week of September 14, 2015.[37] On August 7, 2015, the launch schedule was amended to provide more time for ensuring system security and stability, with the first certificate to be issued in the week of September 7, 2015 followed by general availability in the week of November 16, 2015.[38] The cross-signature from IdenTrust is planned to be available when Let's Encrypt opens for the public.[21]
On September 14, 2015, Let's Encrypt issued its first certificate, which was for the domain helloworld
On October 19, 2015, the intermediate certificates became cross-signed by IdenTrust, causing all certificates issued by Let's Encrypt to be trusted by all major browsers.[20]
On November 12, 2015, Let's Encrypt announced that general availability would be pushed back and that the first public beta would commence on December 3, 2015.[40] The public beta ran from December 3, 2015[41] to April 12, 2016.[42]
Certificates issued
| Date | Certificates issued |
|---|---|
| March 8, 2016 | 1 million[43] |
| April 21, 2016 | 2 million[44] |
| June 3, 2016 | 4 million[45] |
| June 22, 2016 | 5 million[*][46] |
| September 9, 2016 | 10 million[47] |
| November 27, 2016 | 20 million[48] |
| December 12, 2016 | 24 million[49] |
| June 28, 2017 | 100 million[50] |
| August 6, 2018 | 115 million[51] |
| September 14, 2018 | 380 million[52] |
Comments
Post a Comment
https://gengwg.blogspot.com/