A nonprofit effort aimed at encrypting the entire Web has reached an important milestone: its HTTPS certificates are now trusted by all major browsers.
The service, which is backed by the Electronic Frontier Foundation, Mozilla, Cisco Systems, and Akamai, is known as Let’s Encrypt. As Ars reported last year, the group will offer free HTTPS certificates to anyone who owns a domain name.
Let’s Encrypt promises to provide open source tools that automate processes for both applying for and receiving the credential and configuring a website to use it securely.
HTTPS uses the transport layer security or secure sockets layer protocols to secure websites in two important ways. First, it encrypts communications passing between visitors and the Web server so they can’t be read or modified by anyone who may be monitoring the connection. Second, in the case of bare bones certificates, it cryptographically proves that a server belongs to the same organization or person with control over the domain, rather than an imposter posing as that organization. (Extended validation certificates go a step beyond by authenticating the identity of the organization or individual.)
Privacy and security advocates have long pushed all websites to offer front-to-end HTTPS protection for all their pages, and the benefits are obvious. The regular occurrence of man-in-the-middle attacks that hijack huge chunks of Internet traffic is one good reason for universal HTTPS. When these types of attacks happen, HTTPS prevents the attackers from reading the diverted traffic or inserting malware into it once it’s forwarded to its final destination.
More recently, revelations from former National Security Agency subcontractor Edward Snowden about indiscriminate surveillance have brought new urgency to the push for widespread Web encryption. Let’s Encrypt was born out of this.
The service plans to open to the public on November 16.
Post updated in third paragraph to better explain how HTTPS works.
