Improving the SRE Experience for 10 Years as a Free, Open, and Automated...
summary
Let’s Encrypt issues free TLS for 500M+ websites and about 7M certificates/day, run by a 25‑person nonprofit (4 devs on Boulder, 9 on SRE) with a ~$4.5M annual budget. Built components include the ACME protocol, public CT logs and a new static CT API (Sunlight), plus the ACME renewal info endpoint for advance renewal windows. Operations use physical datacenters, air‑gapped root HSMs and vertical DB scaling. Upcoming changes: ending OCSP, offering opt‑in 6‑day certs and short‑lived IP certs — automation and renewal monitoring are necessary.
AI-written summary · about
chapters (38)
- 0:00Introduction
- 0:45History of TLS
- 2:40Problems with TLS
- 4:34TLS Alternatives
- 5:07The Goal
- 6:03The Sponsors
- 6:33Becoming Trusted
- 6:50Initial Setup
- 7:07Becoming Audited
- 7:54Root Programs
- 9:31Cross Sign
- 10:33Trust and Transparency
- 10:54Open Source
- 11:49Open Incident Reporting
- 13:28Acme Protocol
- 14:41Supporting ACME
- 15:13CT Logs
- 16:24Lets Encrypt Team
- 16:39ISRG
- 17:05Team
- 17:23Efficiency
- 18:10SREcon
- 18:31Cut Features
- 19:34Costs
- 19:57Technical Details
- 20:14Behind the Curtain
- 21:24Hardware is Cheap
- 21:45Vertical Scaling
- 22:53Software Stack
- 23:29Memory Safety
- 25:11Software Development
- 25:44Upcoming Updates
- 25:59revocation changes
- 28:16renew info endpoint
- 30:58expiration emails
- 34:38reducing certificate lifetimes
- 36:04conclusion
- 36:57sponsorships
