Let's Encrypt is a free, automated and open certificate authority run by the nonprofit Internet Security Research Group (ISRG). It issues domain-validated certificates using the ACME protocol and is trusted by all major browsers.
Why it matters
It removed the cost and paperwork barrier to HTTPS, and it popularized short-lived certificates: its certificates have been valid for 90 days, which pushes site owners to automate renewal. It supports wildcard certificates through DNS-01 validation, and it publishes rate limits to protect the service. Check its documentation for current lifetimes, since the industry is moving toward shorter validity periods.
Because certificates are short-lived, failures show up quickly. A stopped renewal job, a changed firewall or an expired DNS API token can take a site offline within weeks. Let's Encrypt retired its OCSP responders in 2025, favoring CRLs.
Example
sudo certbot --nginx -d example.com -d www.example.com
sudo systemctl list-timers | grep certbotThe second command confirms the renewal timer is scheduled. Use the staging environment (--staging) while testing so you avoid production rate limits.
Common mistakes
- Treating a successful first issuance as proof that renewal works.
- Ignoring expiry warning emails, or never setting a contact address.
- Requesting many certificates repeatedly and hitting rate limits.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.