Let’s Encrypt is a free, automated and nonprofit certificate authority that issues domain-validated TLS certificates to anyone who can prove control of a domain name. In internet trust, it is the certificate authority that made HTTPS the default for the web by removing the two main barriers to encryption: cost and manual effort.
It is operated by the Internet Security Research Group (ISRG) and issues certificates exclusively through ACME, the Automatic Certificate Management Environment protocol standardized as RFC 8555. Its roots are trusted by all major browsers and operating systems, and it has become one of the largest certificate issuers in the world by number of active certificates.
How Let’s Encrypt issues a certificate
Issuance is a fully automated dialogue between an ACME client on the server and the ACME server of the certificate authority. The client registers an account key, submits an order for one or more domain names, and receives a set of challenges. Once a challenge is satisfied for every name, the client sends a certificate signing request, and the CA returns the signed certificate together with its intermediate chain.
The challenge is the heart of domain validation. It proves that the requester controls the domain at the moment of issuance, either by serving a token over HTTP, by publishing a TXT record in DNS, or by answering a special TLS handshake. The CA checks the response from several network vantage points, which makes it harder to fool validation by hijacking one route.
| Challenge type | What the client proves | Typical use | Wildcard support |
|---|---|---|---|
| HTTP-01 | Serves a token at /.well-known/acme-challenge/ on port 80 | Single web servers | No |
| DNS-01 | Publishes a TXT record at _acme-challenge | Wildcards, internal hosts, load balancers | Yes |
| TLS-ALPN-01 | Presents a special certificate on port 443 | TLS terminators without port 80 | No |
Certificate properties and lifetime
Let’s Encrypt issues only domain-validated certificates. It does not offer organization validation or extended validation, so a certificate confirms control of a name but says nothing about the legal identity behind a site. Certificates may cover many names through the Subject Alternative Name extension and may include wildcards when validated with DNS-01.
The defining property is the short lifetime. The standard certificate is valid for 90 days, and the organization has announced a gradual move toward shorter terms, including short-lived certificates of about six days for subscribers who opt in. Short lifetimes limit the damage of a compromised key and push operators toward automation.
| Parameter | Typical value | Practical effect |
|---|---|---|
| Validation level | Domain validation only | No organization name in the certificate |
| Standard lifetime | 90 days | Renewal needed roughly every 60 days |
| Key types | RSA 2048 to 4096 bits, ECDSA P-256 or P-384 | ECDSA gives smaller, faster handshakes |
| Revocation information | Certificate revocation lists | Online status checks were retired |
| Price | Free of charge | Cost is no barrier to HTTPS |
The recommended practice is to renew when about one third of the lifetime remains, which for 90-day certificates means after roughly 60 days. Modern clients can also use ACME Renewal Information, which lets the CA suggest a renewal window, for example ahead of a mass revocation.
Let’s Encrypt compared with commercial certificate authorities
A Let’s Encrypt certificate provides the same encryption strength as a paid domain-validated certificate: browsers show no difference in the padlock or connection security. The differences lie in validation options, support, lifetime and contractual terms.
| Aspect | Let’s Encrypt | Commercial CA |
|---|---|---|
| Cost | Free | Annual fee per certificate or plan |
| Validation levels | Domain validation only | DV, OV and often EV |
| Issuance method | ACME automation only | ACME, web portal or API |
| Lifetime | 90 days or shorter | Up to the industry maximum |
| Support | Community forum | Contractual support and warranty |
| Rate limits | Per account, domain and name set | Usually governed by contract |
Several commercial CAs now also offer free ACME-based DV certificates, so the main reason to choose a paid CA is a requirement for organization-validated identity, contractual guarantees or specific compliance rules.
Running Let’s Encrypt in production
Success with Let’s Encrypt depends on reliable automation and monitoring. Many web servers, reverse proxies, control panels and hosting platforms include an ACME client; others use a standalone client run by a scheduler. The decisive design choice is the challenge type, which depends on network layout.
- Use the staging environment for testing, because it has far higher rate limits and issues untrusted test certificates.
- Monitor expiry independently of the client, since a silent renewal failure is the most common cause of outages.
- Reload services after renewal, or the new certificate is not served even though it exists on disk.
- Store DNS API credentials narrowly when using DNS-01, ideally restricted to the
_acme-challengerecords.
The CA enforces rate limits to protect its infrastructure, for example on new certificates per registered domain per week and on repeated certificates for the same set of names. Production setups rarely hit them, but misconfigured retry loops can, which then blocks issuance for days.
Limitations and common misconceptions
A frequent misconception is that a free certificate is less secure. The cryptography is the same; what differs is the scope of validation. Conversely, a padlock from Let’s Encrypt does not mean a site is trustworthy: phishing sites can and do obtain DV certificates, so HTTPS proves encrypted transport, not good intent.
Other limitations are practical. Hosts that are not reachable from the internet cannot use HTTP-01 or TLS-ALPN-01, older devices may not trust newer root certificates, and every issued certificate is logged publicly in certificate transparency logs, which exposes internal hostnames to anyone who searches them.
In simple terms
Let’s Encrypt is a free service that gives websites the certificates they need for the padlock in the browser. Before it existed, site owners usually had to pay and fill in forms by hand. Many simply did not bother.
Let’s Encrypt checks that you really control a website address. Then it hands out a certificate automatically, in a few seconds. The certificate expires after a few weeks, so software renews it on its own. The result is that encrypted websites are now the norm.
A practical example
A regional newspaper runs its site on three web servers behind a load balancer and also needs certificates for staging hosts that are not reachable from the internet. Paid certificates had been renewed manually once a year, and two expired certificates caused outages in the past three years.
The operations team installs an ACME client on a management host and chooses DNS-01 validation, using a DNS API token limited to _acme-challenge records. One wildcard certificate covers *.paper.example and the apex domain. The client renews every 60 days, pushes the certificate to the load balancer and reloads it, and a separate monitor alerts if any certificate has fewer than 20 days left.
Over the next year renewals run without intervention, the certificate budget drops to zero, and the team has no expiry-related outages.