Ben Laurie

Background

Ben Laurie is an English software engineer and cryptographer whose work spans web server security, open-source cryptographic tooling, and internet standards. He became known within the open-source community in the mid-1990s for his contributions to secure web infrastructure at a time when encrypted web traffic was still uncommon and often legally constrained by export-control rules on cryptography.

Apache-SSL and the Rise of HTTPS

Laurie wrote Apache-SSL, an early patch set that added SSL/TLS encryption support to the Apache HTTP Server. According to the history documented for Apache's later official SSL module, mod_ssl, the mod_ssl project was "initially created in April 1998 by Ralf S. Engelschall via porting Ben Laurie's Apache-SSL 1.17 source patches" onto a newer Apache codebase. When Engelschall's fork diverged from Laurie's continuing development, the two lines were eventually reconciled by merging the early mod_ssl code with a newer release of Apache-SSL. This lineage means that much of the encrypted-web infrastructure built on Apache in the late 1990s and 2000s traced directly back to code Laurie originally wrote, making his work a foundational, if often uncredited, piece of the web's shift toward HTTPS.

Security and Cryptography Research

Beyond Apache-SSL, Laurie worked and published across a range of security and cryptography topics over the following years, including network forensics, security protocols, and academic research into the mathematics of "ideal knots" and its relevance to DNA replication. He co-authored reference books on Apache server administration, including editions of "Apache: The Definitive Guide," and continued to write and speak on open-source security engineering.

Certificate Transparency at Google

By the early 2010s, Laurie was working at Google, where he turned his attention to a structural weakness in the web's certificate authority (CA) system: any of hundreds of trusted CAs worldwide could mis-issue a certificate for any domain, often without the domain owner's knowledge. This risk became concrete in 2011, when the Dutch certificate authority DigiNotar was compromised and used to issue fraudulent certificates, an incident that undermined trust in the existing CA model. In response, Laurie, together with Google colleagues Adam Langley and Emilia Kasper, began developing an open framework for publicly logging and auditing certificate issuance, initially circulated under the codename "Sunlight." Their proposal was submitted to the Internet Engineering Task Force and was ultimately published in June 2013 as RFC 6962, "Certificate Transparency," with Laurie listed as the lead author.

Impact and Deployment

Certificate Transparency established a system of public, append-only logs in which certificate authorities (or other parties) submit newly issued TLS certificates, allowing domain owners, browser vendors, and security researchers to detect mis-issued or rogue certificates. Major browser vendors, including Google's own Chrome browser, went on to require Certificate Transparency compliance for publicly trusted certificates, making the system a de facto requirement across the web's certificate ecosystem. In 2024, the Internet Society's Levchin Prize for Real-World Cryptography was awarded to Laurie along with his co-creators "for creating and deploying Certificate Transparency at scale," recognizing the project's practical, internet-wide impact roughly a decade after its initial publication.

Other Activities

Laurie was also known for briefly serving on the advisory board of WikiLeaks in its early years, later expressing public skepticism about the technical protections the organization offered its sources. Separately, in earlier stages of his career, he developed a multiplayer online game (MUD) called "Gods." Across his career, Laurie's work has consistently centered on making internet infrastructure more verifiably secure, whether through encrypting web traffic at the server level or making the certificate authority system publicly auditable.

Timeline

• 1998-04Ralf S. Engelschall creates the first version of mod_ssl by porting Ben Laurie's Apache-SSL 1.17 patches onto a newer Apache codebase, per mod_ssl's documented project history.
• 2011The DigiNotar certificate authority is compromised and used to issue fraudulent certificates, exposing weaknesses in the CA trust model that motivate Laurie's later work on Certificate Transparency.
• 2012Laurie, Adam Langley, and Emilia Kasper at Google submit an IETF draft for an open certificate-logging framework, developed under the codename "Sunlight."
• 2013-06RFC 6962, "Certificate Transparency," is published by the IETF with Ben Laurie as lead author alongside Adam Langley and Emilia Kasper.
• 2024Laurie and his co-creators receive the Internet Society's Levchin Prize for Real-World Cryptography for creating and deploying Certificate Transparency at scale.