Free Certificates Are Out of Beta

Out of beta as of yesterday

Let's Encrypt, the free certificate authority run by a non-profit group, left its public beta yesterday. It has issued certificates to anyone who asked since December, and as of this week it is officially a finished service.

A certificate is what lets a website load over HTTPS, with the padlock in the address bar and the connection between visitor and server encrypted.

For years, putting your own domain on HTTPS meant a yearly bill and someone's time to install and renew a certificate. Many small sites went without, or relied on a host's shared one.

Free certificates remove the bill. They do not remove the renewing, which is why most of what follows is about renewal.

What a free certificate proves

Before issuing a certificate, Let's Encrypt checks that whoever asked for it controls the domain, usually by having the server place a particular file where it can be read from outside.

That is domain validation, the same check behind the cheapest paid certificates. The encryption is as strong as theirs, and browsers show the same padlock.

What it does not prove

• Who runs the business, or whether it exists at all.
• That the site is honest; fraudulent sites can get one too.
• That the site is safe from hacking or malware.
• The company's name, which only extended validation displays.
• Any warranty, which some paid certificates include.

The second is worth telling staff. A padlock only shows that the connection is encrypted, not who is at the other end, and some phishing pages carry one.

Where a paid certificate still fits

Extended validation, which puts the company's verified legal name in green beside the address in most browsers, still costs money and paperwork. It suits banks and large online shops more than most small businesses.

A paid certificate also suits a setup that cannot renew automatically, since it lasts a year or more rather than ninety days.

For a typical small business site with a contact form or a login, a free certificate protects visitors just as well as the paid one it replaces.

Ninety days, on purpose

Every Let's Encrypt certificate expires ninety days after it is issued. That is deliberate: short lives limit the damage if a key is stolen, and they make renewing by hand tedious enough that people automate it.

The usual practice is to renew at about sixty days, which leaves a month to sort things out if an attempt fails.

When renewal does fail, the result is worse than having no certificate. Browsers stop visitors at a warning that fills the screen, and few click past it.

Automatic renewal is the point

Renewal is only automatic if something on the server does it on a schedule, without anyone needing to remember.

On a server you manage, that is a scheduled task your developer sets up and tests. On shared hosting the account usually lacks the access to do it, so it depends on the host.

A certificate obtained by hand and pasted into the control panel works perfectly for ninety days. Then it stops, on a date nobody wrote down.

Let's Encrypt emails reminders before a certificate expires, to whatever address was given when it was requested. If that was a developer's personal address, or an inbox nobody reads, the reminders go nowhere.

A worked example

A voice-over artist records commercials and narration in a home studio. Clients log in to a private area of her website to upload scripts and download the finished audio.

In January, the person who looked after the site generated a free certificate by hand and pasted it into the hosting control panel. The login page finally had the padlock it should always have had.

At the start of April it expired. A producer downloading a commercial on deadline got a browser warning instead, and emailed to ask what was wrong with the site.

Nothing had been set to renew it, because her hosting plan did not support Let's Encrypt. The reminder emails had gone to the address of the person who set it up, who had since moved on.

The fix was another plan with the same host, which issues and renews free certificates itself and sends failure notices to the studio's address. A monthly calendar note says to check the expiry date.

The certificate she has now is the same kind as before. The difference is that nothing about it depends on anyone remembering.

The host's part

Hosts differ. A few already let you switch on a free certificate in the control panel and renew it for you; others offer it only on some plans, and some refuse outside certificates on shared hosting.

Ask yours four questions: is it available on my plan, does it renew automatically, who is told if renewal fails, and does it cover the address with and without www?

If the answer to the second is no, a free certificate may cost more in emergencies than a paid one costs in fees.

Why automatic renewals still fail

Renewal can fail for reasons nobody connects with the certificate: the domain pointed at a new server, a security plugin blocking the check that proves control of the domain, or the whole site put behind a password during a redesign.

So automatic renewal still needs a person, not to do the work but to hear when it fails.

The expiry date is a few clicks from the padlock in any browser. After a change to hosting or domain settings, check it when renewal is due; if it has not moved, renewal has stopped.

The counter-case

If your host cannot automate renewal and you cannot move plans, a paid certificate lasting a year may be the practical choice until it can.

A site with no forms or logins has less at stake, although it still gains the padlock. And a business that needs its legal name shown beside the address still needs extended validation.

For most small business sites, though, a free certificate that the host renews automatically is now the sensible default.

Before switching it on

1. Ask your host whether your plan supports it.
2. Confirm renewal happens automatically.
3. Send failure notices to an address you read.
4. Cover both addresses, with and without www.
5. Move every page to HTTPS with redirects.
6. Recheck the certificate after any hosting change.
7. Put the expiry date in the calendar.

Step two decides whether a free certificate is an improvement or a future emergency. One that renews itself costs nothing; one that depends on a person will lapse sooner or later.

The older workaround it replaces is covered in shared SSL that shows the host's name.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.