What is Let's Encrypt?

What it is

Let's Encrypt is run by the Internet Security Research Group, a nonprofit, and began issuing certificates in 2015. Its certificates are trusted by all the major browsers and operating systems. They are domain-validated SSL certificates: Let's Encrypt checks that you control the domain and nothing else.

How it works

There is no form to fill in and nobody to pay. Software on the server, called an ACME client, asks Let's Encrypt for a certificate. Let's Encrypt replies with a challenge to prove control of the domain, either a file the server must publish at a set address or a record that must appear in DNS. When the proof checks out, the certificate is issued and installed. The same software renews it before it expires.

• Certbot: the best-known client, maintained by the Electronic Frontier Foundation.
• Built in: web servers and proxies such as Caddy and Traefik, most hosting control panels, and firewalls such as OPNsense can request certificates themselves.
• In Kubernetes: cert-manager requests and renews certificates for services in a Kubernetes cluster.

What to know before relying on it

• Short lifetimes by design: certificates have been valid for 90 days, and Let's Encrypt is moving to shorter ones. Renewal has to be automatic. A certificate renewed by hand will eventually be forgotten.
• Wildcards need DNS: a certificate for every subdomain can only be proved through a DNS record, so the client needs access to your DNS provider.
• Internal systems: a server that is not reachable from the internet can still get a certificate through the DNS method, as long as it uses a real domain name.
• Rate limits: there are limits on how many certificates one domain can request in a period. Normal use never reaches them, but a misconfigured script can.
• No company validation: it does not issue organization-validated or extended-validation certificates. Few sites need them.
• Watch the renewals: automatic renewal fails quietly when DNS changes, a firewall rule moves or a server is rebuilt. Monitor the expiry date.

How KawaConnect works with Let's Encrypt

We use Let's Encrypt certificates on the Linux servers, reverse proxies and Kubernetes clusters we build, with renewal automated and the expiry dates watched. Where a site sits behind Cloudflare, the certificate visitors see comes from Cloudflare and the one on the server is handled separately. We document which method each system uses so a renewal problem can be traced quickly.

Learn more

• Let's EncryptThe project's own site, with documentation, status and announcements about certificate lifetimes.
• How Let's Encrypt worksThe challenge and issuance process explained step by step.
• CertbotInstructions for getting a certificate on a given web server and operating system.
• cert-manager documentationThe standard tool for certificates inside Kubernetes.
• Let's Encrypt on WikipediaThe project's history, sponsors and scale.