Let's Encrypt is a free, automated certificate authority run by the non-profit Internet Security Research Group. It issues the same kind of domain-validated SSL certificate that paid authorities sell, trusted by every current browser, and renews it automatically through a protocol called ACME. For almost every website it is the right certificate. This guide covers how to get one on shared hosting, on your own server and on WordPress, how to keep it renewing, and the few cases where paying makes sense. What a certificate is and what it proves are explained in what an SSL certificate is and how HTTPS works.
Quick answer
- On shared or managed hosting: look for "SSL", "Let's Encrypt" or "AutoSSL" in the control panel and switch it on for every domain and
wwwalias. Renewal is automatic. - On your own server: install certbot and run
sudo certbot --nginx -d example.com -d www.example.com(or--apache). It installs the certificate and a renewal timer. - Or use a web server that does it built in, such as Caddy.
- On WordPress: get the certificate from the host first, then switch the site address to
https://and fix oldhttp://links. - Certificates last 90 days today, falling to 64 days in February 2027 and 45 days in February 2028. Test renewal with
certbot renew --dry-runand monitor expiry. - Check the result with the SSL checker.
What Let's Encrypt is
Let's Encrypt started issuing certificates in 2015 to make HTTPS the default on the web, and it now issues certificates for hundreds of millions of sites. Its certificates are:
- Domain validated (DV): it checks that you control the domain, not who you are. Browsers show exactly the same thing for DV, OV and EV certificates.
- Free, with no account, no payment and no limit on how many domains you secure, apart from rate limits against abuse.
- Short-lived: 90 days today. Following the CA/Browser Forum's move to shorter certificates, Let's Encrypt has announced 64-day certificates from 10 February 2027 and 45-day certificates from 16 February 2028. Short lifetimes are safe only because renewal is automatic.
- Available as wildcards (
*.example.com), if you validate through DNS.
Let's Encrypt does not offer organisation or extended validation, warranties or phone support. It also stopped sending expiry reminder emails in June 2025, so your own monitoring has to catch a failed renewal.
How validation works
An ACME client on your side asks Let's Encrypt for a certificate, and Let's Encrypt asks it to prove control of each name. There are three ways:
| Challenge | How you prove control | Wildcards | Good for |
|---|---|---|---|
| HTTP-01 | Serve a token at http://example.com/.well-known/acme-challenge/… on port 80 | No | Most single servers |
| DNS-01 | Publish a TXT record at _acme-challenge.example.com | Yes | Wildcards, many servers, no port 80 |
| TLS-ALPN-01 | Answer a special TLS handshake on port 443 | No | Proxies that only have port 443 |
HTTP-01 is the default in most tools. It needs port 80 open and the /.well-known/acme-challenge/ path reachable, which is why a firewall rule or a redirect that swallows that path is the most common reason renewals fail. Redirecting it to https:// is fine; blocking it or sending it to another host is not.
Getting a certificate on hosting you don't manage
Most hosts issue Let's Encrypt certificates for you:
- cPanel: SSL/TLS Status, then "Run AutoSSL". AutoSSL uses Let's Encrypt or Sectigo depending on the host, and renews on its own.
- Plesk: SSL It! or the Let's Encrypt extension under the domain, with "Secure the www subdomain" ticked.
- Managed WordPress hosts, Netlify, Vercel, GitHub Pages and similar: certificates are issued automatically when you add a custom domain and its DNS points at them. Some let you choose between Let's Encrypt and another authority.
- Cloudflare: the certificate visitors see is Cloudflare's edge certificate, issued automatically. Your origin server still needs its own certificate for Full (strict) mode; see Cloudflare errors 525 and 526.
If your host charges for a certificate and does not offer a free one, that is a reason to ask, or to move. Free, automatic certificates have been standard across hosting for years.
Getting a certificate on your own server
Certbot with nginx or Apache
Certbot, from the Electronic Frontier Foundation, is the most used ACME client. On Ubuntu or Debian the snap package is the recommended install:
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot
sudo certbot --nginx -d example.com -d www.example.comUse --apache for Apache. Certbot validates each name with HTTP-01, edits the server block to use the new certificate and, with --redirect, adds the http:// to https:// redirect. It points nginx at fullchain.pem, which includes the intermediate certificate; keep it that way.
Renewal is a systemd timer (or cron job) that runs twice a day and renews each certificate well before it expires, about 30 days ahead on a 90-day certificate. Prove it works:
sudo systemctl list-timers | grep certbot
sudo certbot renew --dry-runCertbot reloads nginx or Apache after a renewal when it installed the certificate with --nginx or --apache. If you used certonly, add a deploy hook, or the server keeps serving the old certificate:
sudo certbot renew --deploy-hook "systemctl reload nginx"Other ACME clients
- Caddy gets and renews certificates for every site in its configuration with no extra setup, and redirects HTTP to HTTPS on its own. See Caddy: the two-line HTTPS server.
- acme.sh is a shell-only client with DNS plugins for most providers, handy for wildcards.
- Traefik and other reverse proxies have ACME built in.
Wildcard certificates
For *.example.com, use DNS-01. With certbot and a DNS provider plugin (Cloudflare, Route 53, DigitalOcean and many others), renewal stays automatic. Without a plugin you would add the TXT record by hand every time, which defeats the point. A wildcard covers one level, so request example.com and *.example.com together.
Rate limits
Let's Encrypt limits issuance to prevent abuse. The ones you might meet, from its rate-limit documentation:
- 50 new certificates per registered domain (such as
example.comand all its subdomains) every 7 days. - 5 certificates for the exact same set of names every 7 days.
- 5 failed validations per name, per account, per hour.
Renewals are largely exempt. You only hit these by reissuing in a loop, usually a script or container that requests a new certificate on every start. Test with --dry-run or the staging server (--test-cert) while you experiment.
Installing SSL on WordPress
WordPress does not issue certificates; your host or server does. The order:
Get the certificate for
example.comandwww.example.comfrom the host panel or with certbot, and check thathttps://example.comloads.Switch WordPress to HTTPS. In Settings → General, change both WordPress Address and Site Address to
https://. Since WordPress 5.7, Tools → Site Health offers an "Update your site to use HTTPS" button once HTTPS works, which also rewrites old links in content as they are shown.Replace old
http://links in the database so the change is permanent. With WP-CLI:Shell wp search-replace 'http://example.com' 'https://example.com' --skip-columns=guid --dry-runRemove
--dry-runwhen the counts look right, and take a backup first.Redirect
http://tohttps://at the server or host ("Force HTTPS"), not with a plugin if you can avoid it.Check for mixed content: images, scripts or fonts that theme or page builder settings still load over
http://. See mixed content: finding and fixing http:// leftovers.
A plugin that "adds SSL" only rewrites links and adds redirects; it cannot create a certificate. Once the steps above are done, you do not need it.
Check that it works
The SSL checker performs a real TLS handshake, reads the certificate your server sends and checks the chain against the public roots. It also tests the http:// redirect and looks for http:// files on the page, the two things that keep a new certificate from giving you a clean HTTPS site.
A fresh Let's Encrypt certificate shows about 90 days left. If you check again a few weeks later and it has fewer than 30, renewal is not running: the expiry finding warns under 30 days and fails under 7. Email alerts before expiry are part of monitoring, a funded unlock; until then, re-run the check after any server or DNS change.
When a paid certificate is worth it
Paying changes nothing visitors see and nothing about the encryption. It makes sense when:
- A contract, tender or compliance rule requires an OV or EV certificate with your company name in it.
- You need a warranty, or a support line from the authority.
- A system cannot automate renewal, such as some appliances, older load balancers or embedded devices. Even then, paid certificates are subject to the same maximum lifetimes (200 days for certificates issued from 15 March 2026), so plan for renewing more often.
For a normal website, a free certificate that renews itself is cheaper and safer than a paid one that someone must remember.
Common mistakes
- Only
example.comon the certificate. Addwww.example.comtoo; visitors reach both. - Blocking or redirecting
/.well-known/acme-challenge/to another host. Issuance works once by hand, and renewal fails silently later. - Using
certonlywithout a deploy hook, so the server keeps the expired certificate in memory. - Reissuing on every container start and hitting the weekly limit. Store the certificates in a volume.
- Assuming Let's Encrypt will email you before expiry. It no longer does.
Questions people ask
Is Let's Encrypt really free?
Yes. Let's Encrypt charges nothing for certificates, has no paid tier and needs no account beyond what your ACME client creates automatically. It is funded by donations and sponsors through the non-profit Internet Security Research Group. The costs you might see come from hosts that charge for installing it or from your own time; on most hosting it is a switch in the control panel.
Is Let's Encrypt trusted by all browsers?
Yes. Let's Encrypt's root certificate, ISRG Root X1, is in the trust stores of Chrome, Firefox, Safari, Edge, Android, iOS, Windows and macOS, so visitors see the same secure connection as with any paid certificate. Very old devices, such as Android versions before 7.1.1 that have not been updated, may not trust it, but they also cannot open much of the modern web.
How long does a Let's Encrypt certificate last?
A Let's Encrypt certificate lasts 90 days today. Let's Encrypt has announced 64 days for certificates issued from 10 February 2027 and 45 days from 16 February 2028, following industry-wide limits. Certbot and most other clients renew about 30 days before expiry on today's certificates, so a working setup renews roughly every 60 days without anyone touching it.
Can I get a free wildcard SSL certificate?
Yes. Let's Encrypt issues wildcard certificates such as *.example.com for free, but only through the DNS-01 challenge, where you prove control by publishing a TXT record. Use an ACME client with a plugin for your DNS provider so renewal stays automatic. A wildcard covers one level of subdomain and not the bare domain, so request both names on one certificate.
How do I install an SSL certificate on WordPress?
Get the certificate from your host's control panel or with certbot first; WordPress cannot create one. Then set both addresses in Settings → General to https://, replace old http:// links in the database with a search-and-replace, redirect all http:// requests to https:// at the server, and check pages for mixed content. Site Health in WordPress 5.7 and later can do the address switch for you.