What is Let's Encrypt?
Let's Encrypt is a free, automated, public certificate authority operated by the Internet Security Research Group (ISRG) that issues short-lived Domain Validation (DV) TLS certificates via the ACME protocol.
Let's Encrypt is a public certificate authority (CA) launched in December 2015 by the Internet Security Research Group (ISRG), a nonprofit organization. Its primary purpose is to make Transport Layer Security (TLS) certificates freely available to everyone, thereby enabling HTTPS encryption for the entire web. It issues only Domain Validation (DV) certificates, not Organization Validation (OV) or Extended Validation (EV) certificates.
The service relies on the Automatic Certificate Management Environment (ACME) protocol, which was standardized in RFC 8555. ACME automates the entire lifecycle of certificate issuance, renewal, and revocation. A client running on the server, such as Certbot or ACME.sh, proves control over a domain name by completing one of several challenge types: HTTP-01 (placing a file at a well-known URL), DNS-01 (adding a TXT record to the domain's DNS zone), or TLS-ALPN-01 (responding on port 443 with a specific TLS handshake). After successful validation, the CA issues a certificate valid for 90 days. Short validity periods minimize the damage from key compromise and force automation of renewal, which is the intended operational model.
Let's Encrypt occupies a foundational role in the internet's Public Key Infrastructure (PKI). It has made HTTPS deployment routine and costless, reducing the percentage of unencrypted HTTP traffic significantly. The CA does not operate behind a paywall or require manual identity vetting from a human. Its root and intermediate certificates are widely trusted by all major browsers and operating systems. Because it is free and fully automated, it is the default choice for personal websites, small businesses, content delivery networks, and cloud providers that need low-cost, high-scale certificate management.
Key facts
- Founded by ISRG with sponsors including Mozilla, Akamai, Cisco, and the Electronic Frontier Foundation.
- Issues DV certificates only, valid for a maximum of 90 days as of the default policy in 2023.
- Uses the ACME protocol (RFC 8555) for fully automated issuance and renewal.
- As of 2023, Let's Encrypt is the world's largest public CA by number of certificates issued per day.
- The entire infrastructure uses a dedicated software stack called Boulder, written in Go.
How it works in practice
Related terms
References
More in TLS & PKI
ACME Protocol
ACME (Automated Certificate Management Environment) is a protocol that automates the issuance, renewal, and revocation of TLS certificates, defined in RFC 8555.
Certificate Authority
A Certificate Authority (CA) is a trusted entity that issues digital certificates after verifying that the requester controls the domain or identity named in the certificate.
Certificate Chain
A certificate chain is an ordered list of certificates, starting with the server certificate and ending with a root CA, that a client validates to establish trust in the server's identity.
Certificate Pinning
A security technique where an application trusts only a specific, pre-selected certificate or public key for a given server, bypassing the standard chain of trust.
Cipher Suite
A cipher suite is a named set of cryptographic algorithms negotiated during a TLS handshake, specifying key exchange, authentication, encryption, and integrity protection for secure communications.
Domain Validation
Domain Validation (DV) is the lowest level of certificate validation used in TLS/SSL, where the certificate authority verifies only that the applicant controls the domain name, typically via an HTTP or DNS challenge.
ECH
Encrypted Client Hello (ECH) is a TLS extension that encrypts the Client Hello message, including the Server Name Indication (SNI), to prevent on-path observers from learning the target hostname during the handshake.
Extended Validation
Extended Validation (EV) is the highest level of TLS certificate assurance, requiring the certificate authority to perform rigorous, human-verified checks on the legal identity and operational existence of the requesting organization before issuance.
HSTS
HTTP Strict Transport Security (HSTS) is a web security policy mechanism that forces browsers to interact with a website only over HTTPS, preventing downgrade attacks and cookie hijacking.
Intermediate Certificate
An intermediate certificate is a subordinate CA certificate signed by a root CA, used to sign end-entity certificates and enable path validation while the root remains offline.