What is Let's Encrypt?

Let's Encrypt is a certificate authority that issues TLS certificates for free, automatically, to anyone who can prove control of a domain. It is run by the Internet Security Research Group, a nonprofit, and it launched to the public in 2015 with the goal of making HTTPS the default for the whole web. It became the largest certificate authority by volume, issuing millions of certificates a day.

What makes it different from older authorities is automation. Instead of a manual purchase, you run an ACME client such as certbot, which proves domain control by answering a challenge, receives the certificate, and renews it on a schedule without anyone involved. That model is why free issuance is sustainable: there is no human in the loop, so there is nothing to charge for.

The trade-off people notice first is the lifetime. Let's Encrypt certificates last 90 days, far shorter than the year-plus lifetimes that commercial authorities long offered. The short life is deliberate — it forces automation and limits the damage of a leaked key — but it means renewal has to work reliably, because a stalled renewal turns into an expired certificate within weeks. Let's Encrypt has also announced even shorter options, including a six-day profile, and plans to shorten the default further.

Two operational notes matter. Let's Encrypt issues domain-validated certificates only, so if a policy requires organisation or extended validation, it is not the right authority. And it enforces rate limits to protect the service, which a runaway renewal loop can hit. For most sites, though, it is the straightforward path to free, automated HTTPS, and its certificates are trusted in every mainstream browser without any extra step.