What Is Let's Encrypt?

Category: Security & SSL ยท Updated 2026-10-31

Let's Encrypt is a free, nonprofit certificate authority that issues domain-validated SSL/TLS certificates automatically using the ACME protocol. Certificates are valid for 90 days and are meant to be renewed automatically by software such as Certbot, rather than manually, which removes both the cost and the manual renewal work of traditional SSL certificates.

Who runs Let's Encrypt and why it is free

Let's Encrypt is a certificate authority (CA) operated by the nonprofit Internet Security Research Group (ISRG), launched with the specific goal of making encrypted HTTPS the default for the entire web. It is funded by sponsorships and donations rather than certificate fees, and it issues only Domain Validated (DV) certificates, which confirm control of a domain but do not check the identity of a company behind it, the way Organization or Extended Validation certificates do.

The ACME protocol: how issuance is automated

Let's Encrypt issues certificates through the ACME (Automatic Certificate Management Environment) protocol instead of a manual web form. An ACME client on the server proves control of the domain, usually by one of two challenge methods, and the certificate authority then issues the certificate automatically with no human review step:

  • HTTP-01 challenge: the client places a specific file at a path under the domain, which the certificate authority fetches to confirm control.
  • DNS-01 challenge: the client creates a specific TXT record in the domain's DNS, useful for wildcard certificates or servers that are not publicly reachable over HTTP.

Installing and renewing with Certbot

Certbot is the most widely used ACME client for Let's Encrypt, maintained by the Electronic Frontier Foundation, and it can obtain a certificate and configure Apache or Nginx in the same step on a VPS or dedicated server.

# Obtain and install a certificate with Nginx
sudo certbot --nginx -d example.com -d www.example.com

# Test that automatic renewal works
sudo certbot renew --dry-run

Certbot installs a scheduled task (a cron job or systemd timer) that checks twice a day and renews any certificate within 30 days of expiry, so a correctly configured server never needs a manual renewal. Most shared and managed hosting control panels run their own ACME client behind the scenes, so there is often nothing for the site owner to install at all.

Why certificates last only 90 days

A short validity period limits the damage if a certificate's private key is ever compromised or if a domain changes hands, since the old certificate becomes useless within weeks rather than years. Because renewal is automatic, the short lifetime is not extra work for the site owner; it only becomes a problem when the renewal process itself breaks, for example when a firewall rule blocks the ACME challenge or a web server configuration changes unexpectedly.

Limitations to know about

  • Only Domain Validated certificates are offered; businesses that need Organization or Extended Validation must buy those from a different certificate authority.
  • Rate limits apply per domain, mainly relevant to sites issuing a very large number of certificates in a short time, such as automated subdomain creation.
  • The domain must be reachable for the HTTP-01 challenge, or DNS must be editable for the DNS-01 challenge; a server with no public access and no DNS control cannot complete either.
  • If automatic renewal fails silently, a certificate can expire and break HTTPS, so monitoring expiry is still worthwhile even with automation in place.

Frequently asked questions

Is Let's Encrypt really free?

Yes. Let's Encrypt is a nonprofit certificate authority that issues domain-validated SSL/TLS certificates at no cost, funded by sponsorships and donations rather than certificate fees.

How long does a Let's Encrypt certificate last?

Let's Encrypt certificates are valid for 90 days. They are designed to be renewed automatically by software such as Certbot well before they expire, rather than tracked and renewed by hand.

What is Certbot?

Certbot is a free, widely used client for the ACME protocol that requests and installs Let's Encrypt certificates and can automatically configure Apache or Nginx, including setting up scheduled automatic renewal.

Is a Let's Encrypt certificate as secure as a paid one?

For encryption strength, yes, since both use the same TLS standards. Paid certificates can add organization or extended validation that confirms a company's identity, which Let's Encrypt's domain-validated certificates do not include.

Why did my Let's Encrypt certificate fail to renew?

The most common causes are a firewall or DNS change blocking the ACME challenge, a web server configuration that moved or removed the challenge file path, or the automatic renewal task being disabled or removed. Running the ACME client manually with verbose logging usually reveals the exact cause.

Can I get a wildcard certificate from Let's Encrypt?

Yes. Wildcard certificates, covering a domain and all of its subdomains, are available from Let's Encrypt but require completing a DNS-01 challenge instead of the simpler HTTP-01 challenge, since no single HTTP path can prove control of every possible subdomain.

Related topics