  Let's Encrypt is a new entrant in the Certificate Authority ecosystem that
offers free and automated certificate signing. It is visionary in its
commitment to Certificate Transparency. In this paper, we shed light on the
adoption patterns of Let's Encrypt "in the wild" and inform the future design
and deployment of this exciting development in the security landscape. We
analyze acquisition patterns of certificates as well as their usage and
deployment trends in the real world. To this end, we analyze data from
Certificate Transparency Logs containing records of more then 18 million
certificates. We also leverage other sources like Censys, Alexa's historic
records, Geolocation databases, and VirusTotal. We also perform active HTTPS
measurements on the domains owning Let's Encrypt certificates. Our analysis of
certificate acquisition shows that (1) the impact of Let's Encrypt is
particularly visible in Western Europe; (2) Let's Encrypt has the potential to
democratize HTTPS adoption in countries that are recent entrants to Internet
adoption; (3) there is anecdotal evidence of popular domains quitting their
previously untrustworthy or expensive CAs in order to transition to Let's
Encrypt; and (4) there is a "heavy tailed" behavior where a small number of
domains acquire a large number of certificates. With respect to usage, we find
that: (1) only 54% of domains actually use the Let's Encrypt certificates they
have procured; (2) there are many non-trivial incidents of server
misconfigurations; and (3) there is early evidence of use of Let's Encrypt
certificates for typosquatting and for malware-laden sites.
