Skip to content
SPECIFICTION
Get listed

Let's Encrypt

letsencrypt.org

Free plan Open source WebWindowsmacOSLinuxAPISelf-hosted
Visit letsencrypt.org
Spec score 8.6 #3 of 26 in Public Key Infrastructure Software

What it is

Let’s Encrypt is a global Certificate Authority that provides SSL/TLS certificates for HTTPS connections. The ACME protocol verifies control of a domain, and compatible clients can automate issuance, management, and renewal. Its client directory includes Apache HTTP Server, Caddy, nginx, Kubernetes, Docker, and Windows/IIS environments. Certificates are Domain Validation only; Let’s Encrypt says it does not plan to issue Organization Validation or Extended Validation certificates. Wildcard certificates are available through the DNS-01 challenge. Standard certificates last 90 days, with an optional six-day lifetime; these periods cannot be adjusted. Subscribers generate and manage private keys on their own servers. Issued and revoked certificates are publicly recorded, and the service says its certificates are trusted by most browsers and operating systems. Certificates cost nothing. A registered domain can receive up to 50 certificates every seven days under published rate limits. Direct subscriber support is not offered.

Spec sheet

What it does
Let's Encrypt is a free, automated, open certificate authority that provides TLS certificates for websites.Read 15 Oct 2026 · letsencrypt.org
Intended users
The service is available to people and organizations worldwide that need certificates for domain-named servers, including web, mail, and FTP servers.Read 9 Oct 2026 · letsencrypt.org
API
The production ACME directory endpoint is https://acme-v02.api.letsencrypt.org/directory and a separate staging endpoint is provided for testing.Read 15 Oct 2026 · letsencrypt.org
Integrations
Hosting providers can obtain and manage certificates for customers through their own ACME clients.Read 15 Oct 2026 · letsencrypt.org
Support
Let’s Encrypt does not offer direct subscriber support and points users to its documentation and community support forums.Read 9 Oct 2026 · letsencrypt.org
License
Boulder is open source under the Mozilla Public License 2.0.Read 15 Oct 2026 · github.com
Headquarters
LinkedIn lists San Francisco, California as ISRG headquarters.Read 15 Oct 2026 · linkedin.com
Maker
The service is operated by the nonprofit Internet Security Research Group.Read 15 Oct 2026 · letsencrypt.org
ACME clients
Users must operate an ACME client; the documentation recommends Certbot for most people and lists many alternatives.Read 15 Oct 2026 · letsencrypt.org
Automation
The ACME protocol verifies control of a domain and is used to issue certificates; clients can automate certificate management and renewal.Read 9 Oct 2026 · letsencrypt.org
Certificate lifetime
Default certificates are valid for 90 days; subscribers can opt in to certificates valid for six days, and these lifetimes cannot be adjusted.Read 9 Oct 2026 · letsencrypt.org
Certificate transparency
Issued certificates are submitted to public Certificate Transparency logs.Read 15 Oct 2026 · letsencrypt.org
Certificate types
The service issues standard Domain Validation certificates for domain-based servers, including web, mail and FTP servers.Read 15 Oct 2026 · letsencrypt.org
Company founded
LinkedIn lists Internet Security Research Group as founded in 2013.Read 15 Oct 2026 · linkedin.com
Company size
LinkedIn lists ISRG as having 11–50 employees.Read 15 Oct 2026 · linkedin.com
Developer testing
The Pebble project is a miniature ACME server intended for client testing, while Boulder is the production CA implementation.Read 15 Oct 2026 · letsencrypt.org
Documentation
The official documentation covers onboarding, ACME clients, rate limits, staging, certificate policy, challenge types, profiles, revocation, compatibility and integration guidance.Read 15 Oct 2026 · letsencrypt.org
Domain validation
Applicants prove domain control through challenges such as DNS records or HTTP resources.Read 15 Oct 2026 · letsencrypt.org
HTTPS automation
The ACME protocol lets an ACME client obtain browser-trusted HTTPS certificates without manual intervention.Read 15 Oct 2026 · letsencrypt.org
Legal structure
ISRG describes itself as a California public benefit corporation recognized as a tax-exempt 501(c)(3) organization.Read 15 Oct 2026 · isrg.org
Limit: abuse complaints
Trustpilot includes one-star complaints alleging that certificates were issued to phishing or scam domains.Read 15 Oct 2026 · trustpilot.com
Limit: issuance limits complaint
A Trustpilot reviewer reported repeated exact-domain certificate rate-limit errors despite claiming no recent changes to the domain.Read 15 Oct 2026 · trustpilot.com
Limit: short validity
G2 reviewers criticize the 90-day lifetime because missed automation can cause certificate expiry and service disruption.Read 15 Oct 2026 · g2.com
Limit: technical setup
G2 reviewers say configuring ACME clients, DNS, web servers, permissions and renewal jobs still requires technical expertise.Read 15 Oct 2026 · g2.com
Multi-domain certificates
A certificate can cover multiple names through the Subject Alternative Name mechanism.Read 15 Oct 2026 · letsencrypt.org
Notable news: API incidents
The official incident forum lists a complete API outage on July 21, 2025 and an ACME API outage on December 16, 2025.Read 15 Oct 2026 · community.letsencrypt.org
Notable news: shorter lifetimes
On February 24, 2026, Let's Encrypt announced a transition from 90-day default certificates to 64-day and then 45-day defaults over two years.Read 15 Oct 2026 · letsencrypt.org
Praise: cost and automation
G2 reviewers repeatedly praise the zero certificate cost, automated issuance and renewal, trusted browser recognition, and ease of integrating ACME with servers and hosting panels.Read 15 Oct 2026 · g2.com
Private keys
Let's Encrypt never generates or stores certificate private keys; they remain on the subscriber's servers.Read 15 Oct 2026 · letsencrypt.org
Rate limits
The API applies token-bucket limits, including up to 10 new accounts per IP address every three hours and 300 new orders per account every three hours.Read 15 Oct 2026 · letsencrypt.org
Rating on G2
4.8 out of 5 from 22 reviews.Read 15 Oct 2026 · g2.com
Rating on Trustpilot
2.2 out of 5 from 20 reviews.Read 15 Oct 2026 · trustpilot.com
Renewal exemption
Renewals coordinated through ACME Renewal Info are exempt from all rate limits.Read 15 Oct 2026 · letsencrypt.org
Security assurance
ISRG publishes certification practice statements, certificate policies and WebTrust audit reports for its CA operations.Read 15 Oct 2026 · letsencrypt.org
Self-hosting
Boulder can be adapted to operate an internal, non-publicly-trusted ACME certificate authority, although its maintainers say it is often not the right production fit for organizations evaluating it.Read 15 Oct 2026 · letsencrypt.org
Transparency
Issued and revoked certificates are publicly recorded and available for inspection.Read 9 Oct 2026 · letsencrypt.org
Trust
Let’s Encrypt says its certificates are trusted by most browsers and operating systems.Read 9 Oct 2026 · letsencrypt.org
Unsupported uses
The service does not issue certificates for email encryption or code signing.Read 15 Oct 2026 · letsencrypt.org
Validation limits
Let's Encrypt has no plans to issue Organization Validation or Extended Validation certificates.Read 15 Oct 2026 · letsencrypt.org
Wildcard certificates
Wildcard certificates are supported, but wildcard issuance requires the DNS-01 challenge.Read 15 Oct 2026 · letsencrypt.org

Plans and prices

Let's Encrypt certificates Free Free; no fee is charged for certificates. Domain Validation (DV) certificates · default validity 90 days, with optional six-day certificates · no OV or EV certificates Read 9 Oct 2026 · letsencrypt.org
Let's Encrypt certificates Free Free Domain Validation certificates · default 90-day validity · automatic renewal through ACME clients Read 15 Oct 2026 · letsencrypt.org
Short-lived certificates Free Free Six-day validity · renewal recommended every three days Read 15 Oct 2026 · letsencrypt.org

Every Let's Encrypt plan and price →

Strong points and limits

Strong points

  • Free Domain Validation certificates
  • ACME supports automated renewal
  • Wildcard certificates available
  • Private keys remain on subscribers’ servers
  • Clients cover major server environments

Limits

  • No Organization Validation or Extended Validation certificates
  • Default certificates last 90 days
  • Wildcard issuance requires DNS-01
  • No direct subscriber support

Who it suits

Let’s Encrypt suits people and organizations worldwide that need certificates for domain-named web, mail, or FTP servers. It is particularly suited to environments where ACME clients can automate certificate operations.

Verdict

Let’s Encrypt provides free, automated HTTPS certificates with broad client and platform coverage. Its short, fixed lifetimes, public certificate records, and lack of direct support are important operating conditions.

Where Specifiction places it

Alternatives to Let's EncryptAll alternatives →