Skip to content

Improving the SRE Experience for 10 Years as a Free, Open, and Automated Certificate Authority#

SREcon25 Americas digest Program Core pick 25–27 March 2025

Recording

Matthew McPherrin, Internet Security Research Group (Opening Plenary) — Core

Play the recording: Improving the SRE Experience for 10 Years as a Free, Open, and Automated Certificate Authority

  • Why: A decade of operational history from the team running Let's Encrypt — now securing 500M+ websites — on what it actually takes to run free, automated PKI issuance reliably at Internet scale, plus a preview of upcoming changes to the ecosystem every TLS operator depends on.
  • What: A retrospective on ten years of Let's Encrypt's certificate authority and Certificate Transparency log operations, covering lessons for anyone managing TLS certificates and guidance on upcoming changes to the CA. (from abstract only)
  • How: Not detailed mechanically in the abstract; framed as historical/operational context plus forward guidance rather than a single technique. (from abstract only — thin on mechanism)
  • Where applicable: General; directly relevant to the same certificate-lifecycle/crypto-agility theme surfaced in the Netflix Enigma talk at USENIX Security '25 this cycle (see that digest) — shortening cert lifetimes make automated issuance like Let's Encrypt's the operational baseline, not an option.