Certificates cost nothing now, so everything is HTTPS

Let's Encrypt came out of beta in April. We have spent the weeks since moving everything behind it, and the interesting part is not the gateway — that was already TLS — but everything else.

The endpoints nobody would have paid for

A wildcard certificate used to cost a few hundred a year, which meant a quiet argument every time someone wanted TLS on a staging host, an internal metrics page, or a docs site serving nothing but public text. The argument was always resolved the same way: it is only public text, leave it on port 80.

That reasoning was wrong even when certificates were expensive. Plain HTTP on a docs site means an intermediary can rewrite the curl command a developer is about to paste into their terminal. We were serving example requests over a channel anyone on the same café wifi could edit.

Every host we run now redirects to HTTPS. The staging ones too.

What actually took the time

Issuing certificates was the easy part. The work was in renewal, because a certificate that expires in ninety days will expire at the worst possible moment unless renewal is boring and automatic.

We renew at sixty days, alert loudly if a renewal fails twice, and treat an expiring certificate as a page-worthy incident rather than a ticket. The failure mode of forgetting is total: the API stops working for everyone at once, and the error the client sees is confusing enough that they will blame their own code first.

What is next

We are turning on HSTS this quarter, with a short max-age to begin with and a longer one once we are confident nothing is left on plain HTTP. Preload submission comes after that.

None of this is novel work. It is just that the excuse for not doing it disappeared last month.