Let's Encrypt Explained
What Let's Encrypt Is
Let's Encrypt is a free, automated certificate authority that issues publicly trusted SSL/TLS certificates for domain names at no charge. A certificate authority is an organisation whose certificates browsers trust. Let's Encrypt is run as a nonprofit project by the Internet Security Research Group.
Its certificates are accepted by major browsers and operating systems because its root certificates are included in their trust stores. Visitors see the same padlock as with a paid certificate, since the encryption is the same. The certificate confirms control of the domain, not the identity of the business behind it.
For a comparison with paid options, see free vs paid SSL certificates.
How Automated Issuance and Renewal Work
Let's Encrypt is built on the ACME protocol. A client running on the server requests a certificate, proves control of the domain through a challenge and receives the certificate automatically. The same client renews it before it expires, so nobody has to buy or upload a certificate by hand.
Certificates from this service have short lifetimes, measured in months rather than years. Short lifetimes limit how long a stolen key or an outdated configuration stays useful, and they make automation necessary. A certificate that is not renewed by a working process will still expire, so monitoring matters.
Limits to Know Before You Rely on It
Let's Encrypt issues only domain validated (DV) certificates. It checks that the applicant controls the domain but does not verify the organisation's name, so it does not offer organisation-validated or extended-validation certificates.
It also applies rate limits, which cap how many certificates a domain or account can obtain within set periods, and limits repeated failed validations. These protect the service from abuse, but a misconfigured script can be blocked for a while. Wildcard certificates are available, but only through DNS validation.
Renewal depends on the same validation working every time. If the server address or DNS records change, renewal can fail without any visible sign, which is why certificate expiry and renewal is worth understanding.
Example: A Blog That Renews Itself
A personal blog runs on a small virtual server. Its owner installs an ACME client that obtains a certificate for the blog's domain and renews it automatically. Months later, the certificate renews without anyone noticing. A year later, the hosting provider changes the server's address, and the validation check starts failing. The client logs errors that nobody reads, and the certificate eventually expires. Automation needs monitoring as well.
Frequently asked questions
Is Let's Encrypt really free?
Yes. Certificates from Let's Encrypt are issued at no charge, and the service is run as a nonprofit. Free does not mean weaker encryption, since its certificates use the same cryptography as paid domain-validated ones. Costs for the server and DNS still apply.
Can Let's Encrypt issue wildcard certificates?
Yes, but only through DNS validation. The client must create a specific DNS TXT record to prove control of the domain. The resulting wildcard covers one level of subdomains, like any wildcard certificate.