Let's Encrypt free SSL

What Let’s Encrypt is

Let’s Encrypt is the certificate authority of a nonprofit called ISRG. The certificate it issues is DV. You prove that you control the domain. Company papers are not required. There is no fee. Because browsers trust this authority, the site shows a lock. That lock does the same job as the lock on a yearly DV card. Both encrypt the session. Neither writes a company name.

The split between DV, OV, and EV is in the SSL types article. Let’s Encrypt does not issue OV or EV. If the legal name has to sit inside the certificate, look at the OV or EV cards on the OwnHost SSL page. The plus and minus list for free versus a paid card is in the comparison article.

How it validates

Validation uses an automatic protocol called ACME. Three common paths exist. HTTP-01 places a short file on the site. DNS-01 adds a TXT record on the domain. TLS-ALPN-01 uses a short handshake on port 443. For one name and www, HTTP-01 is enough on most hosting panels. A wildcard, *.example.com, needs DNS-01. You cannot get a star certificate by uploading a file.

Automation is part of the job for that reason. A client on the panel or the server renews before the certificate expires. Uploading a file by hand each time gets fragile as the lifetime shrinks. Let’s Encrypt does not recommend manual renewal.

How many days is the lifetime in October 2026?

The default lifetime is still 90 days. That is the classic profile in place since 2015. Most certificates use it. Two shorter profiles are optional. The shortlived profile lasts 6 days. The tlsserver profile has issued 45 days since 13 May 2026. Both are opt-in. An account that does not choose them stays on 90 days.

The 7 October 2026 announcement changes the default. From 10 February 2027 the classic profile will issue 64 days. Accounts that already chose a shorter profile can stay on 45 or 6 days. A certificate issued or renewed after that date carries 64 days. The announcement says the last 90-day certificate should expire around 11 May 2027. Certificates that are already valid are not revoked for this change. Staging moved to 64 days on 14 October 2026. They ask you to look at staging before production.

On 16 February 2028 the classic profile drops to 45 days. The authorization reuse period shrinks too. In 2027 it goes from 30 days to 10 days, and in 2028 to 7 hours. On 15 March 2029 the industry rule sets a 47-day maximum on publicly trusted certificates. The shortening is not unique to Let’s Encrypt. Paid authorities follow the same calendar. A card sold by the year cannot live longer than the maximum the authority is allowed to print. When that day comes, the yearly product will renew more often too.

How to set renewal

A fixed rule of “renew every 60 days” is not enough for a 64-day or 45-day certificate. Let’s Encrypt says to renew at about two thirds of the lifetime. On 90 days that is around day 60. On 64 days it is earlier. On 45 days it is about day 30. ACME Renewal Information, ARI, tells the client when to renew. If the client knows ARI, do not keep the date by hand. If it does not, find hardcoded days such as 60, 80, or 83 in cron and switch them to the two-thirds rule.

Renewal is not the same counter as a new name. The 24 February 2026 note says renewals sit outside the limit. The new-order limit is 300 new orders per account per three hours. Renewing thousands of existing certificates does not hit that limit. Opening new domain names does. A limit means free is not the same thing as unlimited speed.

Advantages

There is no fee. DV is enough for a blog and a one-name site. Once automation is in place, 90, 64, or 45 days is not your calendar. The client renews. A wildcard stays free on a panel that can write the DNS record automatically. Browser trust prints the same lock as a paid DV. Passwords and card data do not travel as plain text on that session.

Disadvantages

There is no OV or EV. The company name is not in the certificate. A commercial warranty bond is not part of this product either. The OwnHost SSL page writes, in its own text, a warranty of up to $1,750,000 for Comodo SSL when the problem comes from the certificate. That sentence cannot be copied onto Let’s Encrypt.

If a manual renewal is forgotten, the lock drops. The browser warns. Forms and checkout stop. When the lifetime becomes 64 days in 2027 and 45 days in 2028, forgetting gets more frequent. Without DNS-01, a panel cannot issue a wildcard. New names have an hourly limit. Free does not mean every company installs it for you.

Which line is on OwnHost?

The WordPress hosting card lists free SSL. That line does not name an authority. Do not read this article as “that line is Let’s Encrypt”. If you want a yearly commercial DV, wildcard, OV, or EV, the order is on the SSL page. Comodo SSL (DV) starts at $6.50 a year. Installation is free on a card you buy. If you run Let’s Encrypt yourself on a server, you watch the ACME client and the renewal time. Do not install both on the same name and let them collide. One valid chain on one name is enough.