lego vs Let's Encrypt

lego is an independent, free, open-source ACME client and Go library for obtaining, renewing, and revoking certificates. It supports wildcard and SAN certificates and can work with multiple ACME servers, including Let’s Encrypt and ZeroSSL. Validation choices include DNS-01, HTTP-01, TLS-ALPN-01, and DNS-PERSIST-01. The project lists more than 200 DNS providers, including Cloudflare, Amazon Route 53, Google Cloud DNS, and Azure DNS, with CNAME support enabled by default. Users can run lego from the command line or call it as a Go library. DNS credentials and settings are supplied through environment variables, with file references and dotenv files supported. Installation options include prebuilt binaries, Docker, package managers, and source. The maintainers look after the AUR and Snap packages; other listed packages are community maintained. The project lists support for ACME RFC 8555 and certificate validation and renewal extensions. It is licensed under MIT, and installing from source requires Go 1.25 or later. The project points to GitHub issues and discussions for help.

Let’s Encrypt is a global Certificate Authority that provides SSL/TLS certificates for HTTPS connections. The ACME protocol verifies control of a domain, and compatible clients can automate issuance, management, and renewal. Its client directory includes Apache HTTP Server, Caddy, nginx, Kubernetes, Docker, and Windows/IIS environments. Certificates are Domain Validation only; Let’s Encrypt says it does not plan to issue Organization Validation or Extended Validation certificates. Wildcard certificates are available through the DNS-01 challenge. Standard certificates last 90 days, with an optional six-day lifetime; these periods cannot be adjusted. Subscribers generate and manage private keys on their own servers. Issued and revoked certificates are publicly recorded, and the service says its certificates are trusted by most browsers and operating systems. Certificates cost nothing. A registered domain can receive up to 50 certificates every seven days under published rate limits. Direct subscriber support is not offered.