Let's Encrypt

Let's Encrypt is a free, automated and open certificate authority run by the nonprofit Internet Security Research Group (ISRG). It issues domain-validated certificates using the ACME protocol and is trusted by all major browsers.

Why it matters

It removed the cost and paperwork barrier to HTTPS, and it popularized short-lived certificates: its certificates have been valid for 90 days, which pushes site owners to automate renewal. It supports wildcard certificates through DNS-01 validation, and it publishes rate limits to protect the service. Check its documentation for current lifetimes, since the industry is moving toward shorter validity periods.

Because certificates are short-lived, failures show up quickly. A stopped renewal job, a changed firewall or an expired DNS API token can take a site offline within weeks. Let's Encrypt retired its OCSP responders in 2025, favoring CRLs.

Example

sudo certbot --nginx -d example.com -d www.example.com
sudo systemctl list-timers | grep certbot

The second command confirms the renewal timer is scheduled. Use the staging environment (--staging) while testing so you avoid production rate limits.

Common mistakes

• Treating a successful first issuance as proof that renewal works.
• Ignoring expiry warning emails, or never setting a contact address.
• Requesting many certificates repeatedly and hitting rate limits.

Related

• ACME protocol
• ACME challenge
• Wildcard certificate
• गाइड: Let's Encrypt renewal failures

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.