Let's Encrypt Exits Beta: Free SSL for Small Business Websites

On 12/4/2016, the Let's Encrypt project announced it was officially leaving beta. It is a free, automated and open SSL/TLS certificate authority run by the nonprofit ISRG. For small business websites, the cost of certificates used to be a barrier; that barrier has now almost disappeared.

What is Let's Encrypt?

Let's Encrypt is a certificate authority (CA). Certificates it issues are trusted by popular browsers, so a website shows the HTTPS padlock just as with a paid certificate. According to the project's introduction page, its core principles are:

• Free: anyone who owns a domain can request a certificate at no cost.
• Automated: software on the server can request, install and renew certificates without manual steps.
• Transparent: every certificate issued or revoked is publicly recorded.
• Open: the issuance protocol (ACME) is published as an open standard.

In its announcement of 12/4/2016, the project said that since starting testing it had issued more than 1.7 million certificates for more than 3.8 million websites, and the "beta" label was no longer needed.

Why should small websites turn on HTTPS?

HTTPS encrypts data between the visitor's browser and the server. The practical benefits include:

• Protecting information: contact forms, logins and order details can't be eavesdropped on when sent over public Wi-Fi.
• Building trust: customers see the padlock in the address bar and feel less hesitant to leave a phone number or email.
• Ranking signal: since August 2014, Google has announced that it uses HTTPS as a ranking signal. The initial impact was described as small, so don't expect a sudden jump in rankings just from turning on HTTPS.
• Web standard: the more sites move to HTTPS, the more likely pages still on HTTP are seen as outdated.

How it works, in simple terms

According to the project's description, client software (an ACME client) running on the web server proves to Let's Encrypt that you control the domain, for example by placing a challenge file on the website or a DNS record. After validation, the certificate is issued and recorded in a public log. Renewal repeats this process, so configure it to run automatically instead of remembering to renew by hand.

Things to note when deploying

1. Does your hosting support it? Many hosting services let you install certificates with built-in tools; if you use shared hosting, ask your provider first. You need permission to install certificates, not just to edit the website's source code.
2. Redirect addresses: after turning on HTTPS, set up a 301 redirect from http:// addresses to https:// so traffic isn't split in two.
3. Check for mixed content: images, scripts or CSS still loaded over http:// can make the browser report the page as not fully secure.
4. Update internal links, sitemap and analytics tools to the new address https://.
5. Monitor certificate expiry: make sure automatic renewal works, because an expired certificate makes browsers warn your visitors.

When do paid certificates still make sense?

Free certificates validate control of the domain. If a business needs certificate types that validate the organization, or requires warranty or dedicated support, it can consider other certificate types. For most business introduction websites, blogs and news sites, a free certificate is enough for basic encryption needs.

2026 update: HTTPS is now almost the default of the web, browsers clearly warn about unencrypted pages, and Let's Encrypt remains one of the major CAs serving websites. Renewal cycles and methods are far more automated than in 2016; see the current documentation of Let's Encrypt and your hosting provider.

If you need help setting up HTTPS for your website, you can contact HVSC's Technology team.

FAQ

Is Let's Encrypt really free?

Yes. According to the project's introduction page, anyone who owns a domain can request a trusted certificate without paying a certificate fee. You may still pay for hosting or an installation service if you ask someone else to do it.

Does turning on HTTPS slow down a website?

There is an extra step to set up the encrypted connection, but on a properly configured server the difference is usually very small compared with the benefits for security and customer trust.

Does a small online shop have to use HTTPS?

If the page has forms, logins or collects customer information, you should use HTTPS. For online payments, payment gateways usually have their own security requirements; check the terms of your payment gateway provider.

Reference sources

• Let’s Encrypt — Leaving Beta, Look Out World (12/4/2016): https://letsencrypt.org/2016/04/12/leaving-beta-new-sponsors.html
• Let’s Encrypt — About: https://letsencrypt.org/about/
• Let’s Encrypt — How It Works: https://letsencrypt.org/how-it-works/
• Google Search Central Blog — HTTPS as a ranking signal (8/2014): https://developers.google.com/search/blog/2014/08/https-as-ranking-signal