Ten years ago this month, a certificate authority no one had heard of issued its first publicly-trusted certificate. It was a small, unglamorous event: one TLS certificate, for one domain, generated by automated software. But it was the start of the quietest revolution in web security, one that did more than any single platform change to make encryption the default.
The before
Before Let's Encrypt, HTTPS was a chore. A working certificate cost roughly fifty to a hundred dollars a year, and getting one meant filling out forms, waiting for validation, installing the file, and renewing it by hand before it lapsed. For a hobby site or a small business, the cost and friction were real. Encryption was something you paid for and babysat, so most of the web simply skipped it.
The idea
Let's Encrypt, run by the nonprofit Internet Security Research Group (ISRG, incorporated May 24, 2013), took a different bet. Make certificates free. Make issuance automated. And define a machine protocol, ACME, so any client could talk to any CA. Backed by an early coalition that included the EFF, Mozilla, Cisco, Akamai, and University of Michigan researchers, with IdenTrust cross-signing early certificates so browsers would trust them, the project launched publicly in November 2014 and went generally available on December 3, 2015. ACME later became an IETF standard as RFC 8555 in March 2019, which let dozens of clients and other CAs plug into the same automation.
The flywheel of 90-day certificates
Here is the clever part. Let's Encrypt issues certificates that last only 90 days. That sounds like a burden, but it is the point: a certificate you must renew every three months cannot be managed by hand. It forces automation to be excellent. Once renewal is automatic, short lifetimes stop being inconvenient and start being a feature, limiting the damage of a compromised or mis-issued certificate. Automation became a cornerstone of the whole strategy.
The numbers
The results speak for themselves. The one millionth certificate came in March 2016; the 100 millionth in June 2017; the billionth in 2020. In September 2018, helped by Squarespace and Shopify integrations, Let's Encrypt issued a million certificates in a single day for the first time. By late September 2025 it was passing ten million a day, and it now protects hundreds of millions of sites, closing in on a billion active ones. W3Techs finds Let's Encrypt behind roughly two-thirds of websites whose certificate authority is known.
The real measure is prevalence. It took about five years to lift the global share of encrypted connections from below 30% to around 80%, where it has stayed; in the United States it hovers near 95%. Browsers helped by labeling plain HTTP "not secure" starting in 2018, but they could only do that because the free, automated path existed.
The lesson
Let's Encrypt's legacy is not a certificate count. It is the idea that removing cost and friction from security makes people take the secure path. HTTPS became the boring, default choice, and that is exactly what good infrastructure should be.
For your next project, treat that as a design principle: if the secure option is also the easy option, people will choose it. And if you have not yet automated your own TLS renewals, that is a ten-minute job today, and it is the single most fitting way to honor the anniversary.