What Is a Let's Encrypt Certificate?

A Let's Encrypt certificate is a free certificate that lets a website use HTTPS, so browsers show it as secure and encrypt the connection. Let's Encrypt is a certificate authority that issues these certificates to software rather than through a manual order. The software also renews them before they expire.

How it works

A program on the web server, called an ACME client, asks Let's Encrypt for a certificate for your domain. Let's Encrypt checks that you control the domain, either by fetching a file from a well-known address on your site over plain HTTP, or by looking up a DNS record you were asked to create. If the check passes, it issues the certificate and the web server starts using it.

Certificates are valid for 90 days by default, and Let's Encrypt recommends renewing them every 60 days. Because renewal is automatic, you normally never see it happen. Let's Encrypt does not charge for its certificates. Wildcard certificates, such as one for *.example.com, are only issued through the DNS check.

When to use it

• Any public website or API on its own domain. Browsers warn visitors about sites without HTTPS.
• Sites of any size where a domain-validated certificate is enough, which is the only kind Let's Encrypt issues.

When not to use it

• When a contract or policy requires an organization-validated (OV) or extended-validation (EV) certificate. Let's Encrypt does not issue those; buy one from a commercial authority instead.
• For a server that cannot be reached on port 80 or 443 from the internet and whose DNS records you cannot create for each renewal: no check can pass.

How it works on VeloxaHost

• Managed web hosting. HTTPS from Let's Encrypt is issued automatically once your domain points at the site. Add the DNS records shown on the site's page, and the web server (Caddy) gets the certificate and keeps it renewed. Nothing to install or schedule. See managed web hosting and the hosting plans.
• On a VPS. You run the ACME client yourself, for example Caddy or Certbot. Apart from the DNS check, the checks need your domain's address to reach the server on port 80 or 443 (Caddy uses port 80 for the HTTP check and 443 for its TLS check). The shared IPv4 port block cannot offer those ports, so give the server a dedicated IPv4 address; US East has no IPv6 yet. The DNS check needs no open port, but the client has to create a record in your DNS zone at every renewal, so you need a client that can do that for your DNS host, or you add the record by hand each time.

FAQ

Is a Let's Encrypt certificate really free?

Yes. Let's Encrypt does not charge for certificates. On VeloxaHost managed hosting, HTTPS is part of the plan.

How long does a Let's Encrypt certificate last?

90 days by default. ACME clients renew it automatically, and Let's Encrypt recommends renewing every 60 days.

Do I have to renew it myself on VeloxaHost hosting?

No. On managed hosting the web server renews the certificate automatically.

Why can't my VPS get a certificate on the shared IPv4 address?

The usual checks need port 80 or 443 on your domain's address, and those ports on a shared address are not yours. Add a dedicated IPv4 address, or use the DNS check.