WebBuilding

Organizations

Let's Encrypt

Summary

Let's Encrypt is a free, automated certificate authority run by the nonprofit Internet Security Research Group (ISRG). Announced on November 18, 2014 and opened to the public on December 3, 2015, it issues the certificates websites need for HTTPS through an open protocol, ACME, standardized as RFC 8555 in 2019. As of October 2026, W3Techs finds its certificates on 64.4% of all websites.

Web Building Encyclopedia · Organizations · Last reviewed October 22, 2026 · 11 min read

What Let’s Encrypt is

Let’s Encrypt is a free, automated and open certificate authority, or CA. A CA is an organization that browsers trust to vouch that a website’s encryption key belongs to the site’s real owner. The certificates it signs are what let a site use HTTPS, the encrypted form of HTTP.1

The service is run by the Internet Security Research Group (ISRG), a nonprofit, and describes itself as run for the public’s benefit.1 It lists six principles: free, automatic, secure, transparent, open and cooperative. In practice that means anyone who owns a domain name can get a trusted certificate at no cost, web server software can get and renew it without a person stepping in, and every certificate it issues or revokes is publicly recorded.1

Let’s Encrypt issues only domain validation (DV) certificates. A DV certificate proves that the applicant controls the domain, and nothing more about who they are. The project says it has no plans to issue organization validation (OV) or extended validation (EV) certificates, and it does not issue certificates for signing code or encrypting email.2

As of October 2026, W3Techs finds Let’s Encrypt certificates on 64.4% of all websites it surveys, and on 67.4% of the sites whose certificate authority it can identify.3

Origins: ISRG and the 2014 announcement

Two groups were working on the same problem in 2012. One, led by J. Alex Halderman of the University of Michigan and Peter Eckersley of the Electronic Frontier Foundation (EFF), was designing a protocol to issue and renew certificates automatically. The other, a Mozilla team led by Josh Aas and Eric Rescorla, was working on a free, automated CA.4

The two efforts merged in May 2013 and formed ISRG to run the new CA.4 ISRG is a California public benefit corporation recognized by the IRS as a 501(c)(3) tax-exempt organization. Its founding directors were Aas and Rescorla, and Let’s Encrypt was its first project. ISRG later added Prossimo, a memory safety project, and Divvi Up, a privacy-preserving metrics system, both launched in 2021.5

A new CA has a chicken-and-egg problem: browsers only trust certificates that chain back to a root certificate they already ship. Let’s Encrypt solved this by signing an agreement with IdenTrust, an established CA, in October 2014 to cross-sign its certificates, so that browsers would trust them through IdenTrust’s root. The founders had also looked at buying an existing root, at an estimated cost of $1 million to $8 million, but did not do so.4

Josh Aas, as ISRG executive director, announced Let’s Encrypt on November 18, 2014. The announcement named Mozilla, Cisco, Akamai, the EFF, IdenTrust and researchers at the University of Michigan as the groups working through ISRG, and set a target of launching in the second quarter of 2015.6 It described the obstacle in a few words: “The challenge is server certificates.” Getting one, it said, could be confusing, usually cost money, was tricky to install correctly and was a pain to update.6

Launch and growth

The launch came later than the 2015 target. Let’s Encrypt issued its first publicly trusted certificate on September 14, 2015.7 A limited beta for invited users followed, and on December 3, 2015, it entered public beta: from that day, anyone could get a free certificate without an invitation. More than 26,000 certificates had been issued during the limited beta.8

Let’s Encrypt left beta on April 12, 2016. By then it had issued more than 1.7 million certificates for more than 3.8 million websites, and it stated its goal as encrypting 100% of the web.9 The same month, WordPress.com switched on free HTTPS for the more than one million custom domains it hosted, crediting Let’s Encrypt for making certificates possible at that scale. WordPress.com had launched its first batch of these certificates in January 2016.10

Later milestones, as listed by the project itself:7

  • March 2016. The one millionth certificate.
  • June 2017. The 100 millionth certificate.
  • September 2018. One million certificates issued in a single day.
  • 2020. The billionth certificate.
  • End of September 2025. More than ten million certificates in one day for the first time.

Wildcard certificates arrived on March 13, 2018, together with ACME version 2. A wildcard certificate covers every subdomain of a domain, such as any name ending in .example.com. To get one, the applicant has to prove control by adding a TXT record to the domain’s DNS, a method called the DNS-01 challenge.11

ISRG’s own root certificate was accepted into all major browser and platform root programs as of August 2018. A 2019 paper by the project’s founders and engineers, presented at the ACM CCS security conference, said Let’s Encrypt would start issuing certificates that chain to that root by default from July 2020.4 The old IdenTrust root that had cross-signed its certificates, DST Root CA X3, expired on September 30, 2021, and from then on Let’s Encrypt relied on its own root, ISRG Root X1, for trust on almost all devices. Some older devices that never received ISRG Root X1, such as the iPhone 4, began showing warnings on Let’s Encrypt sites. Older Android phones kept working through a special cross-sign from DST Root CA X3.12 That workaround also ended: Let’s Encrypt stopped serving the longer cross-signed chain by default on February 8, 2024 and entirely on June 6, 2024, and the cross-sign expired on September 30, 2024.13

The 2019 paper also reported that about two-thirds of ISRG’s budget went on staff. It spent about $3.0 million in 2018, and in May 2019 it had 13 full-time staff. Corporate sponsors provided 83% of its 2018 funding.4

How it works: ACME and Certbot

Let’s Encrypt is designed to issue certificates without human intervention. Everything runs through a protocol called ACME, short for Automatic Certificate Management Environment. Software on the web server, called an ACME client, asks for a certificate, proves control of the domain and installs the result.14

The project’s own description of the steps:14

  1. The client creates an account key pair the first time it contacts Let’s Encrypt. The CA identifies the client by this key.
  2. The CA sets one or more challenges. The client can either put a file at a set address on the site over HTTP, or add a DNS record under the domain.
  3. The CA checks the result from several network locations at once, which makes it harder for an attacker to fake.
  4. Once validated, the client sends a certificate signing request. The CA checks the signatures, issues the certificate and submits it to public Certificate Transparency logs.

Renewing repeats the same steps, and revoking a certificate needs a request signed with the same account key.14

The IETF published ACME as RFC 8555, a Proposed Standard, in March 2019. Its authors were Richard Barnes of Cisco, Jacob Hoffman-Andrews of the EFF, Daniel McCarney of Let’s Encrypt and James Kasten of the University of Michigan. The RFC notes that before ACME, this checking was “done through a collection of ad hoc mechanisms.”15

Certbot

Let’s Encrypt’s official client was first called simply the Let’s Encrypt client, run with the command letsencrypt. On May 12, 2016, it was renamed Certbot and became an EFF project, no longer hosted by ISRG, partly to avoid confusion with the CA. The EFF said it was the most popular choice for organizations and developers running their own web servers.16

Certbot is free, open-source software run from the command line, usually on a Unix-like server, with integrations for the Apache HTTP Server and Nginx.17 Its Nginx mode gets a certificate and edits the Nginx configuration to serve it in one step. The packages install a scheduled job that renews certificates before they expire, and the command certbot renew –dry-run tests that job.18 Certbot renews when less than a third of a certificate’s lifetime remains. Before version 4.0.0 it renewed at a fixed 30 days before expiry.17

Some web servers now speak ACME themselves. NGINX announced a native ACME module, ngx_http_acme, on August 12, 2025. Let’s Encrypt listed Traefik, Caddy and Apache httpd as other servers with built-in support.19

Certificate lifetimes, from 90 days to 45

From the start, Let’s Encrypt certificates have lasted 90 days. In a November 9, 2015 post, Aas gave two reasons: short lifetimes limit the damage from stolen keys and wrongly issued certificates, and they push site owners to automate renewal. He recommended renewing every 60 days and said the project “may consider even shorter lifetimes” once automation was widespread.20 The 2019 paper adds that 90 days is short enough that few people will want to renew by hand every quarter, but long enough to allow it when needed.4

Industry rules are moving the same way. Under the CA/Browser Forum’s Baseline Requirements, the rules all publicly trusted CAs follow, the maximum lifetime falls to 100 days for certificates issued from March 15, 2027 and to 47 days from March 15, 2029.21 Let’s Encrypt announced its own schedule on December 2, 2025:2221

DateChangeDomain check reused for
May 13, 2026Opt-in tlsserver profile issues 45-day certificates7 hours
February 10, 2027Default classic profile moves from 90 to 64 days10 days
February 16, 2028Default classic profile moves to 45 days7 hours

The “domain check reused for” period, called the authorization reuse period, is how long a successful domain check can be used for later certificates without checking again. For the default classic profile it is 30 days until February 10, 2027.2223

On October 7, 2026, Let’s Encrypt confirmed the first step. Every certificate issued or renewed on or after February 10, 2027 will be valid for 64 days by default, and subscribers can choose 45 or 6 days instead. Its staging system, used for testing, was set to begin issuing 64-day certificates on October 14, 2026, and the last 90-day certificates are expected to expire around May 11, 2027. Existing certificates will not be revoked because of the change.23

The project’s advice is to let the CA set the timing. ACME Renewal Information (ARI), published by the IETF as RFC 9773 in June 2025, lets a CA tell each client when to renew.24 Clients without ARI should renew at about two-thirds of the certificate’s lifetime. Let’s Encrypt suggests searching scheduled jobs and scripts for fixed values such as 60, 80 or 83 days, which will break.23 Shopify, which renews certificates for millions of merchants’ custom domains, described in a March 2026 post how it replaced its fixed 30-day renewal threshold with ARI.25

Shorter lifetimes mean more renewals: Let’s Encrypt expects daily renewal requests to roughly double. Renewals are exempt from its rate limits, which apply to certificates for new domain names, and it said subscribers would not need any rate limit changes for the switch.26

Retired services and new options

To keep its systems lean, Let’s Encrypt has switched off two long-running services.

  • OCSP. The Online Certificate Status Protocol let browsers ask the CA whether a certificate had been revoked. Let’s Encrypt turned its OCSP service off on August 6, 2025, after removing OCSP addresses from new certificates more than 90 days earlier. It said OCSP was a privacy problem, because the CA could see which sites a visitor’s IP address was checking. Revocation information is now published only in Certificate Revocation Lists (CRLs), files that list revoked certificates.27
  • Expiry emails. Let’s Encrypt used to email subscribers when a certificate was about to expire. That service ended on June 4, 2025. The project gave four reasons: automated renewal had become common, storing millions of email addresses linked to certificates was a privacy cost, the service cost tens of thousands of dollars a year, and it added complexity.28 The stored addresses were deleted from the CA’s database, and email addresses sent through ACME are no longer stored with certificate records.29

It has also added certificates for new uses. Since January 15, 2026, anyone can choose a short-lived certificate, valid for 160 hours (just over six days), through the shortlived profile. The same release made certificates for IP addresses, not just domain names, generally available. These must be short-lived, because IP addresses change more often than domain names. Let’s Encrypt said it had no plan to make six-day certificates the default.30

Scale and impact

Let’s Encrypt gave two different site counts in December 2025. Josh Aas’s executive director’s letter, first published in ISRG’s 2025 annual report and posted on December 29, 2025, said that over the past year Let’s Encrypt went from serving 492 million websites to 762 million, a 50% increase, and was issuing ten million certificates on some days.31 Twenty days earlier, Aas’s December 9, 2025 post marking ten years of certificates said “We’re closing in on protecting one billion web sites” and called Let’s Encrypt the largest CA in the world by certificates issued.7 The two posts do not explain how their site counts differ.

The same two posts also give different starting points for encryption. The December 29 letter says that when Let’s Encrypt started, 39% of page loads on the internet were encrypted, and that today over 95% are in many parts of the world. It does not name the data behind those figures.31 The December 9 post, using Firefox statistics on the share of encrypted connections, says the global figure took about five years to rise from below 30% to around 80%, where it has stayed, and that in the United States it has been close to 95% for a while.7

Independent surveys show its reach. As of October 22, 2026, W3Techs puts Let’s Encrypt ahead of every other certificate authority, used by 64.4% of all websites, against 21.1% for GlobalSign, 4.5% for Sectigo, 3.5% for the GoDaddy Group and 1.6% for the DigiCert Group. One site can use certificates from more than one CA.32

Timeline

  1. Let's Encrypt confirms 64-day default certificates from February 10, 202723
  2. Six-day and IP address certificates become generally available30
  3. Let's Encrypt turns off its OCSP service27
  4. Expiry notification emails end29
  5. ACME Renewal Information is published as RFC 977324
  6. The last DST Root CA X3 cross-sign, kept for older Android phones, expires13
  7. The cross-signing root DST Root CA X3 expires12
  8. The IETF publishes ACME as RFC 855515
  9. ISRG's own root is accepted by all major browser and platform root programs4
  10. ACME v2 and wildcard certificates go live11
  11. The Let's Encrypt client is renamed Certbot and moves to the EFF16
  12. Let's Encrypt leaves beta after more than 1.7 million certificates9
  13. Public beta opens to everyone without an invitation8
  14. The first publicly trusted Let's Encrypt certificate is issued7
  15. Let's Encrypt is announced6
  16. The founding groups merge and form ISRG4

What it means for your website

Most site owners never deal with Let’s Encrypt directly. Its getting-started page says many hosts get and manage certificates for their customers, either automatically or through a setting you switch on, and in that case you do not need an ACME client at all.33 On cPanel hosting, for example, AutoSSL installs certificates on its own, with Let’s Encrypt as the default provider included in the cPanel license.34

  • Check that HTTPS is switched on. Look in your host’s or builder’s dashboard for an SSL or HTTPS setting. Let’s Encrypt charges nothing, though some hosts add a small fee for setting it up.2
  • Know when renewals change. From February 10, 2027, default certificates last 64 days, and from February 16, 2028, 45 days.22 If your host renews for you, nothing changes on your side. If you or a developer wrote a renewal script, make sure it renews at about two-thirds of the lifetime or uses ARI.23
  • On your own server, test Certbot. Run certbot renew –dry-run to confirm the scheduled renewal works.18
  • Set up your own expiry alerts. Let’s Encrypt no longer emails you before a certificate expires. It points to monitoring services instead, such as Red Sift Certificates Lite, free for up to 250 certificates.28
  • Plan certificates into a move. The HTTP-based check asks your site to serve a file at a set address, so a new host may not be able to issue a certificate until your domain points to it. The DNS-based check avoids that.14 During a website migration, ask the new host how it handles this.

Our SSL certificate glossary entry explains the basics, and our guide to domains and hosting covers what to ask a host before you sign up.

See also

References

  1. About Let's Encrypt. Let's Encrypt, ISRG. accessed October 22, 2026.
  2. FAQ. Let's Encrypt, ISRG. accessed October 22, 2026.
  3. Usage statistics and market share of Let's Encrypt. W3Techs. 2026-10. accessed October 22, 2026.
  4. Let's Encrypt: An Automated Certificate Authority to Encrypt the Entire Web. Josh Aas, Richard Barnes, Benton Case, Zakir Durumeric, Peter Eckersley and others, ACM Conference on Computer and Communications Security (CCS '19). 2019-11. accessed October 22, 2026.
  5. About Internet Security Research Group. Internet Security Research Group. accessed October 22, 2026.
  6. Let's Encrypt: Delivering SSL/TLS Everywhere. Josh Aas, Let's Encrypt, ISRG. 2014-11-18. accessed October 22, 2026.
  7. 10 Years of Let's Encrypt Certificates. Josh Aas, Let's Encrypt, ISRG. 2025-12-09. accessed October 22, 2026.
  8. Entering Public Beta. Josh Aas, Let's Encrypt, ISRG. 2015-12-03. accessed October 22, 2026.
  9. Leaving Beta, New Sponsors. Josh Aas, Let's Encrypt, ISRG. 2016-04-12. accessed October 22, 2026.
  10. HTTPS Everywhere: Encryption for All WordPress.com Sites. WordPress.com News. 2016-04-08. accessed October 22, 2026.
  11. ACME v2 and Wildcard Certificate Support is Live. Let's Encrypt Community Support forum. 2018-03-13. accessed October 22, 2026.
  12. DST Root CA X3 Expiration (September 2021). Let's Encrypt, ISRG. accessed October 22, 2026.
  13. Shortening the Let's Encrypt Chain of Trust. Aaron Gable, Let's Encrypt, ISRG. 2023-07-10. accessed October 22, 2026.
  14. How It Works. Let's Encrypt, ISRG. accessed October 22, 2026.
  15. Information on RFC 8555: Automatic Certificate Management Environment (ACME). Internet Engineering Task Force, RFC Editor. 2019-03. accessed October 22, 2026.
  16. Announcing Certbot: EFF's Client for Let's Encrypt. Brad Warren, Electronic Frontier Foundation. 2016-05-12. accessed October 22, 2026.
  17. About Certbot. Electronic Frontier Foundation. accessed October 22, 2026.
  18. Certbot instructions: Nginx on Linux (snap). Electronic Frontier Foundation. accessed October 22, 2026.
  19. Native ACME Support Comes to NGINX. Josh Aas, Let's Encrypt, ISRG. 2025-09-11. accessed October 22, 2026.
  20. Why ninety-day lifetimes for certificates?. Josh Aas, Let's Encrypt, ISRG. 2015-11-09. accessed October 22, 2026.
  21. Profiles. Let's Encrypt, ISRG. accessed October 22, 2026.
  22. Decreasing Certificate Lifetimes to 45 Days. Matthew McPherrin, Let's Encrypt, ISRG. 2025-12-02. accessed October 22, 2026.
  23. 64-Day Certificate Lifetimes Coming Feb 2027. Sarah Gran, Let's Encrypt, ISRG. 2026-10-07. accessed October 22, 2026.
  24. Information on RFC 9773: ACME Renewal Information (ARI) Extension. Internet Engineering Task Force, RFC Editor. 2025-06. accessed October 22, 2026.
  25. Simplifying Certificate Renewals for Millions of Domains with ACME Renewal Information (ARI). Nick Silverman (Shopify), Let's Encrypt blog. 2026-03-17. accessed October 22, 2026.
  26. Shorter Certificate Lifetimes and Rate Limits. Jacob Hoffman-Andrews, Let's Encrypt, ISRG. 2026-02-24. accessed October 22, 2026.
  27. OCSP Service Has Reached End of Life. Josh Aas, Let's Encrypt, ISRG. 2025-08-06. accessed October 22, 2026.
  28. Ending Support for Expiration Notification Emails. Josh Aas, Let's Encrypt, ISRG. 2025-01-22. accessed October 22, 2026.
  29. Expiration Notification Service Has Ended. Josh Aas, Let's Encrypt, ISRG. 2025-06-26. accessed October 22, 2026.
  30. 6-day and IP Address Certificates are Generally Available. Matthew McPherrin, Let's Encrypt, ISRG. 2026-01-15. accessed October 22, 2026.
  31. A Note from our Executive Director (2025). Josh Aas, Let's Encrypt, ISRG. 2025-12-29. accessed October 22, 2026.
  32. Usage statistics of SSL certificate authorities for websites. W3Techs. 2026-10-22. accessed October 22, 2026.
  33. Getting Started. Let's Encrypt, ISRG. accessed October 22, 2026.
  34. Manage AutoSSL. cPanel and WHM documentation, WebPros. accessed October 22, 2026.

Web Building Encyclopedia. First published October 22, 2026. Last reviewed October 22, 2026. Every fact on this page is linked to a source we opened. Spotted an error? Write to [email protected].