Tools · SPBoucher
Menu

Let's Encrypt

In-depth entry

by Internet Security Research Group (ISRG) · Service · also known as Let’s Encrypt, ISRG CA

Nonprofit certificate authority that issues free, automatically renewable TLS certificates through the ACME protocol

MPL-2.0 licenseFreeCloud
Visit official site Compare

Link verified Nov 2, 2026

Overview

Let's Encrypt is a certificate authority operated by the Internet Security Research Group, a nonprofit. It issues domain-validated TLS certificates at no charge and exclusively through automation: a client speaking the ACME protocol proves control of a domain by answering an HTTP, DNS or TLS-ALPN challenge, receives a certificate, and repeats the process before expiry. Certificates are deliberately short-lived so that renewal is scripted rather than remembered, and the CA has been moving toward even shorter lifetimes and additional certificate profiles.

For most operators Let's Encrypt is invisible: Caddy, Traefik, certbot, acme.sh and the ACME integrations in hosting platforms and tunnel gateways request and renew certificates automatically. Wildcard certificates are available through the DNS challenge, which requires API access to the zone, and the staging environment lets administrators test configurations against generous limits. The issuing software, Boulder, is open source under MPL-2.0, and all issued certificates appear in public Certificate Transparency logs.

Its constraints are part of the design. Only domain validation is offered, so organization-validated or extended-validation certificates must come from a commercial CA. Rate limits apply per registered domain and are documented; hosts must be reachable on the public internet or have DNS API credentials for challenges; and the short validity means a broken renewal job becomes an outage within weeks. Operators of private or internal hostnames generally pair Let's Encrypt with a DNS challenge or use an internal CA.

Editorial note on uncertainty. license_spdx applies to the Boulder CA software; the CA itself is a service.

Capabilities

  • Free domain-validated TLS certificates for public hostnames
  • ACME protocol with HTTP-01, DNS-01 and TLS-ALPN-01 challenges
  • Wildcard certificates via DNS validation
  • Staging environment for testing automation
  • Certificate Transparency logging of all issuance
  • Open-source CA software (Boulder)

Typical workflows

  1. Let a reverse proxy such as Caddy or Traefik obtain and renew certificates automatically
  2. Use certbot or acme.sh with a web server that lacks built-in ACME
  3. Issue a wildcard certificate through a DNS provider API
  4. Validate a new setup against the staging endpoint before production

Strengths

  • No cost and no manual renewal when automation is in place
  • Supported by practically every web server, proxy and hosting platform
  • Transparent operations with public incident reporting
  • Nonprofit governance

Limitations

  • Domain validation only; no OV or EV certificates
  • Rate limits per registered domain
  • Requires public reachability or DNS API access for challenges
  • Short certificate lifetimes make broken automation visible quickly

Prerequisites

  • A public domain name
  • An ACME client or a server with built-in ACME support

Who it is for

  • Anyone operating a public website or API
  • Self-hosters and small infrastructure teams
  • Hosting and platform providers

Alternatives & comparison

Cloudflare provides edge certificates automatically when traffic is proxied through its network and also offers origin certificates for the backend hop; Let's Encrypt gives the operator a publicly trusted certificate directly on the origin. Caddy is not a CA but the most common client that uses Let's Encrypt (and ZeroSSL) transparently. Commercial registrars such as GoDaddy sell paid certificates including OV and EV types, which Let's Encrypt does not issue.

  • Caddy

    Go web server and reverse proxy that obtains and renews TLS certificates automatically and is configured with a short Caddyfile or a JSON API

    Open sourceOpen source
  • Cloudflare

    Global network offering authoritative DNS, CDN and reverse-proxy security, a domain registrar, Zero Trust access and the Workers serverless platform

    ProprietaryFreemium
  • GoDaddy

    Domain registrar and web-hosting company offering DNS management, SSL certificates, email and website builders, with a developer API for domains

    ProprietaryPaid
Compare Let's Encrypt with its alternatives →

Sources & verification

Primary sources consulted for this record. Claims are tied to the fields each source supports; the automated link checker re-verifies every URL on a schedule.

  • Official documentation
    Let's Encrypt Documentation

    https://letsencrypt.org/docs

    Supports: capabilities, limitations, workflows

    checked Nov 1, 2026
  • Official site
    Let's Encrypt

    https://letsencrypt.org/

    Supports: name, summary, vendor, pricing_model

    checked Nov 1, 2026
  • Policy page
    Let's Encrypt Privacy Policy

    https://letsencrypt.org/privacy

    Supports: privacy_url

    checked Nov 1, 2026
  • Repository
    letsencrypt/boulder

    https://github.com/letsencrypt/boulder

    Supports: license_spdx, source_model

    LICENSE.txt is Mozilla Public License 2.0.

    checked Nov 1, 2026
Confidence
High
Reviewed
Nov 1, 2026
Links
Verified · Nov 2, 2026

Spotted an error?

Broken link, outdated license, wrong category, or a tool that no longer exists? Tell us; reports are reviewed by the editor.

OVHcloud

OVH Groupe SA · Cloud & hosting providers

European cloud and hosting provider offering dedicated bare-metal servers, public and hosted private cloud, VPS, domains and web hosting from data centers in Europe, Canada and elsewhere

ProprietaryPaidUsage-basedNov 2, 2026