Let’s Encrypt is a free, automated, public certificate authority (CA) that issues domain-validated SSL/TLS certificates to anyone who can prove they own a domain. The service is operated by the non-profit Internet Security Research Group (ISRG); its founders included the Electronic Frontier Foundation, Mozilla, Akamai, Cisco and the University of Michigan, and its operations are still funded by donations and sponsors. Let’s Encrypt began public operations at the end of 2015 and is now one of the world’s largest certificate authorities.

This article explains how Let’s Encrypt works. To find out how to obtain and renew a Let’s Encrypt certificate on aWh’s hosting service, please read the article on free Let’s Encrypt certificates.

How does it work?

Let’s Encrypt is fully automated: there is no registration, no paperwork and no payment required. The certificate is requested by an ACME client (Automatic Certificate Management Environment, a standard protocol), such as Certbot, acme.sh, or, on hosting platforms, the cPanel AutoSSL feature. The steps in the process are as follows:

1. The client specifies which domains they require certificates for.
2. Let’s Encrypt sets a challenge, which the client uses to verify ownership of the domain:
   • HTTP-01: a verification file must be placed at the path http://pelda.hu/.well-known/acme-challenge/;
   • DNS-01: You must add a TXT record for the name _acme-challenge.pelda.hu. This is the only way to request a wildcard certificate;
   • TLS-ALPN-01: authentication takes place on port 443 using a special certificate; this method is used less frequently.
3. Let’s Encrypt verifies the request from several sources before issuing the certificate.
4. The client installs the certificate and automatically repeats the process before it expires.

What does it offer, and what doesn’t it?

• The Domain Validated (DV) certificate, which technically provides the same level of encryption as a paid DV certificate and is accepted by all modern browsers.
• A single certificate can cover multiple domains, and wildcard certificates are also available.
• It does not provide organisational (OV) or extended validation (EV) certification, financial guarantees or a support team. If you require these, you will need a paid certificate; see: Let’s Encrypt or paid SSL: which should I choose?
• Restrictions apply: for example, a maximum of 50 new certificates per week per domain, a maximum of 5 certificates per week for the same name group, and a maximum of 5 failed checks per hour per domain.

How long is it valid for?

Let’s Encrypt certificates are valid for 90 days by default, and this period will be further reduced in the coming years:

Date	Default validity period
currently	90 days
From 10 February 2027	64 days
From 16 February 2028	45 days

Certificates with a 45-day validity period (the tlsserver profile) and a validity period of approximately 6 days (the shortlived profile) are now available. The article ‘Why are SSL certificates no longer valid for a year?’ explains the background to this change. As renewal is automatic, the shorter validity period does not generally entail any extra work for the user.

Changes in 2025

• OCSP has been discontinued. From 7 May 2025, Let’s Encrypt will no longer include an OCSP address in its certificates, and on 6 August 2025, it shut down its OCSP servers. Since then, revoked certificates have been indicated by certificate revocation lists (CRLs).
• Expiry reminder emails have been discontinued. Let’s Encrypt stopped sending pre-expiry warning emails in 2025 (on 4 June, according to the announcement). If you are using it on your own server, you will need to monitor the expiry date yourself.
• ARI. Using ACME Renewal Information, the issuer can notify the client when to renew. According to ARI, scheduled renewals are exempt from issuance limits.

Is it secure?

Yes. Let’s Encrypt certificates are subject to the same rules as those of any other public certificate authority (the CA/Browser Forum’s baseline requirements); every certificate issued is recorded in the public Certificate Transparency logs, and the certificate authority’s software is open source. What is not verified, however, is the identity of the website operator: a DV certificate only verifies that the applicant has control over the domain, not who they are.