Let's Encrypt (SSL certificates)

Let's Encrypt is a free, open and automated certificate authority (CA), launched in 2015 by the non-profit organization ISRG. It issues SSL/TLS certificates that enable encrypted connections over HTTPS — with no fees, formalities or manual verification. Its arrival significantly accelerated the spread of an encrypted internet.

How Let's Encrypt works

The whole process is built on the ACME protocol (Automatic Certificate Management Environment), which automates issuing, installing and renewing certificates. It runs in a few steps:

• domain validation — the client proves control over the domain by placing a specified file or DNS record;
• certificate issuance — after successful validation the CA generates a DV (Domain Validation) certificate;
• installation — the certificate is placed on the server and assigned to the domain;
• automatic renewal — the client (e.g. Certbot) renews the certificate before it expires.

Certificates are valid for 90 days, and this short lifetime combined with full automation is a deliberate design choice that reduces the risk associated with a possible key leak.

Practical application

Let's Encrypt is today the default source of certificates in most hosting environments. Panels such as DirectAdmin, cPanel and Plesk issue and renew them with a single click, so enabling HTTPS on a site requires no technical expertise. DV certificates from Let's Encrypt are entirely sufficient for blogs, business sites and stores — a hosting plan with automatic SSL provides encryption and the trusted padlock symbol in the browser at no extra cost. For certificates covering all subdomains, the wildcard variant is used.