Let's Encrypt

Let’s Encrypt is a global Certificate Authority that issues Domain Validation SSL/TLS certificates for HTTPS and other domain-named servers. It suits people and organizations worldwide who can manage certificates on their own infrastructure. Its free issuance and ACME automation make it a practical fit for routine domain validation, but fixed certificate lifetimes and no direct subscriber support demand reliable operations.

Overview

Let’s Encrypt verifies control of a domain through ACME, then issues certificates that clients can manage and renew automatically. That is a strong approach for operators who want HTTPS certificates without a certificate fee and can configure a compatible client. The service also covers mail and FTP servers, not just websites.

Certificates are Domain Validation only: Let’s Encrypt says it has no plans to issue Organization Validation or Extended Validation certificates. Its certificates are trusted by most browsers and operating systems, while issued and revoked certificates are publicly recorded for inspection. Private keys stay on subscribers’ servers rather than being stored by Let’s Encrypt, which keeps key custody with the operator but also makes server-side key management their responsibility.

Key features

• ACME automation: Clients can automate issuance, deployment, and renewal. This reduces manual certificate work, provided the operator configures and maintains the client environment.
• Broad client directory: Listed environments include Apache HTTP Server, Caddy, nginx, Kubernetes, Docker, and Windows/IIS. That range makes the service relevant across common server and container setups, though users still need a suitable client.
• Wildcard certificates: Wildcards are supported, but issuance must use the DNS-01 challenge. That requirement makes them less straightforward where DNS challenge handling is difficult to automate.
• Fixed lifetimes: Default certificates last 90 days; subscribers can opt in to six-day certificates. Neither lifetime can be adjusted, so dependable renewal automation matters, particularly for the shorter option.
• Rate limits: A registered domain can receive up to 50 certificates every seven days, subject to the published rate limits. High-volume issuance therefore needs to fit within those constraints.
• Support model: There is no direct subscriber support; users are directed to documentation and community forums. Operators who need a direct support channel should look elsewhere.

Pricing

Let’s Encrypt certificates cost nothing, billed Free; no fee is charged for certificates. The free plan includes DV certificates, 90-day default validity with an optional six-day lifetime, automatic renewal, deployment automation, and revocation workflows. There is no free trial because the plan is free.

This is a good fit for individuals and organizations that need DV certificates and can run their own certificate-management setup. The trade-off is not a cheaper paid tier but a defined scope: no OV or EV certificates, no adjustable validity period, and no direct subscriber support. The 50-certificates-per-registered-domain-in-seven-days limit also matters for larger issuance needs.

Platforms

Let’s Encrypt is categorized for API, Linux, self-hosted, web, and Windows environments. Its client directory names integrations including Apache HTTP Server, Caddy, nginx, Kubernetes, Docker, and Windows/IIS, giving administrators several routes to fit certificate automation into existing infrastructure.

Who it's for

Choose Let’s Encrypt if you need free DV certificates for domain-named web, mail, or FTP servers and can handle client configuration, key custody, and renewal operations. It is less suitable if your certificate requirements call for OV or EV validation, a custom certificate lifetime, direct subscriber support, or wildcard issuance without DNS-01.

Pros and cons

Pros

• No certificate fee: The plan is free, making it suitable where DV certificates meet the requirement.
• Automated lifecycle: ACME clients can automate issuance, deployment, and renewal, reducing recurring manual certificate tasks.
• Keys remain on subscriber servers: Let’s Encrypt does not store certificate private keys, leaving key custody with the operator.
• Wide environment coverage: The client directory spans established web servers, Windows/IIS, Kubernetes, and Docker.

Cons

• DV only: There are no OV or EV certificates, so organizations requiring those validation levels need another provider.
• Fixed certificate terms: The 90-day default and optional six-day validity cannot be changed, making reliable renewal especially important.
• Wildcard constraint: Wildcard issuance requires DNS-01, which may complicate setups without DNS challenge automation.
• No direct subscriber support: Help is through documentation and community forums, not a direct support channel.
• Issuance cap: The limit of 50 certificates per registered domain every seven days can constrain higher-volume issuance.

Alternatives

For a broader look at this category, browse Public Key Infrastructure Software or Certificate Management Software.

• OpenCA PKI is a free, open-source PKI management option for Linux, macOS, self-hosted, and web environments; consider it when PKI management software is the priority.
• step-ca is free and offers a configured intermediate CA, an offline root CA, and authority-wide issuance policies; choose it when those CA controls matter, noting that its plan has no Certificate Transparency integration.
• EJBCA has a free Community Edition for learning, testing, and prototyping, plus a free trial; it is a fit for non-production exploration of basic PKI functionality.
• OpenXPKI offers a free, fully functional Community Edition with Debian packages, example configuration, online documentation, and mailing-list support; consider it if that support and packaging model suits your deployment.
• XiPKI is a free Apache License 2.0 option for API, Linux, macOS, and self-hosted environments; consider it when those platform options fit your needs.
• Boulder is free and open source, but production deployment requires separate implementation and security work; choose it when you can take on that work.
• cert-manager is free X.509 certificate management for Kubernetes and OpenShift workloads; it is the more targeted choice for those environments.
• Dogtag Certificate System is free certificate authority software that requires access to 389 Directory Server; consider it if that dependency fits your setup.

Verdict

Let’s Encrypt is a strong choice for operators worldwide who need free DV certificates and can rely on ACME automation to keep them current. The combination of no certificate fee, broad client environments, and subscriber-held private keys is compelling for routine domain security. Look elsewhere when you need OV or EV certificates, a different validity term, DNS-independent wildcard issuance, or direct subscriber support.