Let's Encrypt is the reason HTTPS stopped being something you paid for. It hands out certificates that every mainstream browser trusts, free, to anyone who can prove they control a domain. The catch, if you can call it one, is that the certificates are short-lived on purpose, so the whole thing only works if renewal is automated. Here's how it works, what changed recently, and how to set renewal up so you never think about it.
Let's Encrypt is a certificate authority run by the Internet Security Research Group (ISRG), a non-profit. Its certificates chain up to ISRG Root X1 (RSA) or ISRG Root X2 (ECDSA), which are in the trust stores of current browsers and operating systems.
It issues domain-validated (DV) certificates only. There's no organisation validation and no extended validation, because the whole process is automated and nobody checks paperwork. For a website, that makes no difference to the encryption. A DV certificate from Let's Encrypt protects the connection exactly as well as a paid DV or OV certificate.
Everything happens over ACME, the protocol standardised as RFC 8555. You don't fill in a form. A piece of software on your server (the ACME client) asks for a certificate, proves control of the domain, and installs the result.
Before issuing, Let's Encrypt sets a challenge for each name on the certificate. There are three to choose from:
http://example.com/.well-known/acme-challenge/<token> and Let's Encrypt fetches it. It needs port 80 reachable from the internet. It's the most common method, and it can't issue wildcards._acme-challenge.example.com. It needs your DNS provider to have an API the client can use. It's the only method that can issue wildcard certificates, and it works for servers that aren't reachable from the internet at all.One DNS record can quietly block all of this: CAA. If your domain publishes CAA records and none of them authorise letsencrypt.org, issuance fails. Check with dig example.com CAA +short or our DNS lookup before you blame the client.
As of 2026, Let's Encrypt's default certificates last 90 days. That's already getting shorter.
shortlived ACME profile. These are also the only way to get a Let's Encrypt certificate for an IP address rather than a domain name.tlsserver profile switched to 45-day certificates on 13 May 2026.classic profile drops to 64 days, and the period for which a successful domain validation can be reused drops to 10 days.These dates put Let's Encrypt ahead of the CA/Browser Forum's industry-wide limits, which reach 47 days in March 2029. The reasoning is that a stolen key or a wrongly issued certificate does less damage when it dies in weeks, and that revocation has never worked well enough to rely on. In practice, the takeaway is simple: if your renewal is automated properly, none of this affects you. If it isn't, it's going to break more and more often.
On a typical Linux server with nginx, certbot does the whole job:
sudo certbot --nginx -d example.com -d www.example.comThat obtains a certificate for both names, edits the nginx config and sets up renewal. Most distribution packages and the snap install a systemd timer that runs certbot renew twice a day. Check it exists:
systemctl list-timers | grep -i certbotcertbot renew only renews certificates that are due, so running it often is harmless. By default, certbot treats a certificate as due when a third of its lifetime remains. It also supports ACME Renewal Information (ARI, RFC 9773), which lets Let's Encrypt suggest a renewal window and ask for early renewal if it ever has to revoke certificates in bulk. ARI renewals are also exempt from rate limits.
Two more commands are worth knowing:
sudo certbot certificates
sudo certbot renew --dry-runThe first lists every certificate certbot manages, with its names and expiry. The second runs a full renewal against the staging environment without issuing anything, which is the quickest way to find out whether renewal will actually work.
If you configure your web server yourself, add a deploy hook so it picks up the new files: --deploy-hook "systemctl reload nginx". A renewed certificate on disk is no use if the server is still holding the old one in memory.
certbot isn't the only option. acme.sh, lego and Caddy's built-in ACME support all work, and on Kubernetes, cert-manager is the usual choice. Most hosting panels use Let's Encrypt behind a checkbox.
A few changes catch out people with older setups:
Let's Encrypt limits how fast you can request certificates. The ones people hit are 50 new certificates per registered domain every seven days, 5 certificates for the exact same set of names every seven days, and 5 failed validations per name, per account, per hour. Renewals get special treatment, so normal operation never gets near them.
You usually hit them by testing against production: re-running a broken setup script in a loop, or rebuilding a container that requests a fresh certificate every time it starts. Test with --staging (certbot) or the staging directory https://acme-staging-v02.api.letsencrypt.org/directory instead. Staging certificates aren't trusted by browsers, but the limits are far higher.
No. The encryption is identical. What you pay for with a commercial CA is organisation validation, support, warranties and sometimes longer-standing tooling. None of that changes how well the connection is protected.
Yes, but only through the DNS-01 challenge, so your ACME client needs API access to your DNS provider. A wildcard like *.example.com doesn't cover the bare example.com, so request both names on the same certificate.
The common causes are port 80 blocked or DNS pointing somewhere new (for HTTP-01), expired DNS API credentials (for DNS-01), a missing renewal timer, or a renewal that worked but a server that was never reloaded. Our guide to fixing an expired SSL certificate goes through each one.
If you use a maintained ACME client that runs daily, probably not. Look for anything that assumes a 90-day lifetime. A cron job that only runs renewal once a month can miss the window entirely, and a monitor that alerts at "under 30 days left" will fire for most of a 45-day certificate's life. Tie alerts to a failed renewal or a week or so of remaining life instead.
0 comments
No comments yet. Be the first.