Let's Encrypt

Overview

Let's Encrypt is a free, automated certificate authority run by the nonprofit Internet Security Research Group (ISRG) and funded by sponsors and donations. It issues domain-validated (DV) public TLS certificates entirely through ACME (RFC 8555), which it helped standardize, and it is the reason HTTPS became the default for the public web. There is no ownership or commercial change to note; it remains an ISRG project. For PKI teams it is less a vendor than an upstream dependency whose policy changes ripple into every automated renewal pipeline.

What it is good at

Zero-cost, zero-touch public TLS. Any ACME client (Certbot, Caddy, cert-manager, Traefik, most CDNs and hosting platforms) can request and renew certificates with no account managers, invoices or manual approvals. Validation runs over HTTP-01, DNS-01 or TLS-ALPN-01; wildcard certificates require DNS-01.

It is also the CA most actively pushing shorter lifetimes. Six-day (160-hour) and IP address certificates became generally available in January 2026, ACME Renewal Information was published as RFC 9773 so the CA can tell clients when to renew, and the default lifetime drops from 90 to 64 days on 10 February 2027 and to 45 days in February 2028. If your certificate lifecycle automation works with Let's Encrypt, it is ready for the industry-wide move to 47-day certificates.

Where it falls short

Scope is narrow by design. Only DV certificates for public domain names and IP addresses: no OV or EV, no code signing, no S/MIME, no private CA. Since 2026 it no longer covers client certificates either: the TLS Client Authentication EKU left the default profile on 11 February 2026 and all profiles on 8 July 2026, so anyone who used it for mTLS client or device identity needs a private CA.

Operational support has thinned. Expiration reminder emails ended in June 2025 and OCSP reached end of life in August 2025, leaving CRLs only. Rate limits cap issuance at 50 certificates per registered domain and 5 duplicates per exact identifier set every 7 days. There is no SLA and no paid support, only a community forum, and no inventory or policy console for the certificates you hold.

Pricing

Free, with no paid tier; ISRG is funded by sponsors and donations. It scores at the top of the Identity Pricing Transparency Index. The real cost is your automation and monitoring.

Best for, and who should look elsewhere

Let's Encrypt fits every team that needs public TLS on infrastructure it can automate, from a single site to Kubernetes clusters via cert-manager. Deployment effort is an afternoon for one server; the ongoing work is renewal monitoring, which shorter lifetimes make mandatory. Enterprises with private PKI, client and device certificates, or machine identity inventory needs should look at Smallstep, EJBCA or Keyfactor; buyers who need OV/EV, warranties or an SLA should compare DigiCert vs Sectigo. See the certificate lifecycle management guide.

Bottom line

The default choice for free, automated public TLS, and the best rehearsal for short-lived certificates. It is not a PKI program: client, device and private certificates now have to come from somewhere else.