Let's Encrypt

What is Let’s Encrypt?

Let’s Encrypt is a nonprofit certificate authority that issues domain-validated TLS certificates free, via the ACME protocol: your client proves domain control (an HTTP file or DNS record challenge), receives a certificate, and repeats automatically before expiry. Launched in 2015 when certificates cost real money and were installed by hand annually, it now underpins hundreds of millions of sites — the single biggest reason the web’s HTTPS share went from ~40% to ~95%+.

The 90-day design argument

Short lifetimes look inconvenient and are the point: they bound the damage window of a compromised key, and they force automation — nobody renews manually every 90 days, so the ecosystem built tooling (Certbot, Caddy’s built-in ACME, cert-manager for Kubernetes, load balancers with ACME integrations) that made expiry a solved problem for those who adopted it. The industry agreed with the logic: maximum certificate lifetimes have been ratcheting down ever since, making ACME-style automation mandatory everywhere, paid CAs included.

Choosing challenge types

HTTP-01 is simplest but requires port-80 reachability per host. DNS-01 proves control via DNS record — the only route to wildcard certificates and the right choice for internal hosts that aren’t internet-reachable, at the cost of granting your ACME client DNS-write credentials (scope them narrowly; that credential is now security-critical).

What people get wrong

• Automating issuance but not alerting — renewal silently breaking (moved DNS, changed firewall) surfaces as an outage 60 days later; monitor expiry independently.
• Hitting rate limits during incidents: per-domain issuance limits punish tight retry loops; use the staging environment for testing.
• Treating DV as identity assurance — Let’s Encrypt proves domain control, nothing about the organization behind it; phishing sites have padlocks too.

Primary source: Let’s Encrypt — How It Works