Let's Encrypt is a free, automated nonprofit Certificate Authority operated by the Internet Security Research Group (ISRG). It issues domain-validated (DV) SSL/TLS certificates without charge, making HTTPS encryption accessible to everyone.
The service uses the ACME (Automatic Certificate Management Environment) protocol to automate every step of certificate management. You run client software like Certbot or acme.sh, which generates a key pair, requests a certificate, proves domain control via an automated challenge, and installs the signed certificate — all without manual intervention. Renewal happens automatically via cron or systemd timers.
Domain control is proven using one of three challenge types:
- HTTP-01: Place a file at
/.well-known/acme-challenge/on your web server - DNS-01: Add a TXT record under
_acme-challenge.<domain> - TLS-ALPN-01: Respond to a TLS challenge on port 443
Let's Encrypt issues only domain-validated certificates — no Organization Validation (OV) or Extended Validation (EV). Certificates are valid for 90 days, which is much shorter than commercial CAs' typical 1–2 years. This forces renewal automation but eliminates forgotten renewals leading to outages.
WarningCertificates expire after just 90 days. Always automate renewal with your ACME client; manual renewal is easy to forget. Also, rate limits apply per registered domain, so use the staging environment before rapid reissuance during testing.
Let's Encrypt's root of trust is ISRG Root X1, which is now directly trusted by modern operating systems and browsers. It has issued billions of certificates since launching in 2015.