A Usability Evaluation of Let's Encrypt and Certbot: Usable Security Done Right

Abstract

The correct configuration of HTTPS is a complex set of tasks, which many administrators have struggled with in the past. Let’s Encrypt and Electronic Frontier Foundation’s Certbot aim to improve the TLS ecosystem by offering free trusted certificates (Let’s Encrypt) and by providing user-friendly support to configure and harden TLS (Certbot). Although adoption rates have increased, to date, there has been only a little scientific evidence of the actual usability and security benefits of this semi-automated approach. Therefore, we conducted a randomized control trial to evaluate the usability of Let’s Encrypt and Certbot in comparison to the traditional certificate authority approach. We performed a within-subjects lab study with 31 participants. The study sheds light on the security and usability enhancements that Let’s Encrypt and Certbot provide. We highlight how usability improvements aimed at administrators can have a large impact on security and discuss takeaways for Certbot and other security-related tasks that experts struggle with.

Publication
Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security
Christian Tiefenau
Christian Tiefenau
Postdoc

I’m interested in the field of usability and security with special focus on administrators. If you are interested in collaboration feel free to contact me.

Maximilian Häring
Maximilian Häring
Ph.D. Student