# Let's Encrypt: get a free SSL certificate and keep it renewing

> Let's Encrypt is a non-profit certificate authority that issues free SSL certificates, trusted by every browser and renewed automatically. This guide shows how to get one on your host, your own server or WordPress, and when a paid certificate is still worth it.

Updated 2026-09-26 · Security · HTML version: https://getreport.app/guides/free-ssl-certificate-lets-encrypt

Let's Encrypt is a free, automated certificate authority run by the non-profit Internet Security Research Group. It issues the same kind of domain-validated SSL certificate that paid authorities sell, trusted by every current browser, and renews it automatically through a protocol called ACME. For almost every website it is the right certificate. This guide covers how to get one on shared hosting, on your own server and on WordPress, how to keep it renewing, and the few cases where paying makes sense. What a certificate is and what it proves are explained in [what an SSL certificate is and how HTTPS works](https://getreport.app/guides/ssl-tls-checks-that-matter).

## Quick answer

- **On shared or managed hosting**: look for "SSL", "Let's Encrypt" or "AutoSSL" in the control panel and switch it on for every domain and `www` alias. Renewal is automatic.
- **On your own server**: install certbot and run `sudo certbot --nginx -d example.com -d www.example.com` (or `--apache`). It installs the certificate and a renewal timer.
- **Or use a web server that does it built in**, such as Caddy.
- **On WordPress**: get the certificate from the host first, then switch the site address to `https://` and fix old `http://` links.
- **Certificates last 90 days today**, falling to 64 days in February 2027 and 45 days in February 2028. Test renewal with `certbot renew --dry-run` and monitor expiry.
- Check the result with the [SSL checker](https://getreport.app/tools/ssl-check).

## What Let's Encrypt is

Let's Encrypt started issuing certificates in 2015 to make HTTPS the default on the web, and it now issues certificates for hundreds of millions of sites. Its certificates are:

- **Domain validated (DV)**: it checks that you control the domain, not who you are. Browsers show exactly the same thing for DV, OV and EV certificates.
- **Free**, with no account, no payment and no limit on how many domains you secure, apart from rate limits against abuse.
- **Short-lived**: 90 days today. Following the CA/Browser Forum's move to shorter certificates, Let's Encrypt has announced 64-day certificates from 10 February 2027 and 45-day certificates from 16 February 2028. Short lifetimes are safe only because renewal is automatic.
- **Available as wildcards** (`*.example.com`), if you validate through DNS.

Let's Encrypt does not offer organisation or extended validation, warranties or phone support. It also stopped sending expiry reminder emails in June 2025, so your own monitoring has to catch a failed renewal.

## How validation works

An ACME client on your side asks Let's Encrypt for a certificate, and Let's Encrypt asks it to prove control of each name. There are three ways:

| Challenge | How you prove control | Wildcards | Good for |
| --- | --- | --- | --- |
| HTTP-01 | Serve a token at `http://example.com/.well-known/acme-challenge/…` on port 80 | No | Most single servers |
| DNS-01 | Publish a TXT record at `_acme-challenge.example.com` | Yes | Wildcards, many servers, no port 80 |
| TLS-ALPN-01 | Answer a special TLS handshake on port 443 | No | Proxies that only have port 443 |

HTTP-01 is the default in most tools. It needs port 80 open and the `/.well-known/acme-challenge/` path reachable, which is why a firewall rule or a redirect that swallows that path is the most common reason renewals fail. Redirecting it to `https://` is fine; blocking it or sending it to another host is not.

## Getting a certificate on hosting you don't manage

Most hosts issue Let's Encrypt certificates for you:

- **cPanel**: SSL/TLS Status, then "Run AutoSSL". AutoSSL uses Let's Encrypt or Sectigo depending on the host, and renews on its own.
- **Plesk**: SSL It! or the Let's Encrypt extension under the domain, with "Secure the www subdomain" ticked.
- **Managed WordPress hosts, Netlify, Vercel, GitHub Pages and similar**: certificates are issued automatically when you add a custom domain and its DNS points at them. Some let you choose between Let's Encrypt and another authority.
- **Cloudflare**: the certificate visitors see is Cloudflare's edge certificate, issued automatically. Your origin server still needs its own certificate for Full (strict) mode; see [Cloudflare errors 525 and 526](https://getreport.app/guides/cloudflare-ssl-errors-525-526).

If your host charges for a certificate and does not offer a free one, that is a reason to ask, or to move. Free, automatic certificates have been standard across hosting for years.

## Getting a certificate on your own server

### Certbot with nginx or Apache

Certbot, from the Electronic Frontier Foundation, is the most used ACME client. On Ubuntu or Debian the snap package is the recommended install:

```bash
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot
sudo certbot --nginx -d example.com -d www.example.com
```

Use `--apache` for Apache. Certbot validates each name with HTTP-01, edits the server block to use the new certificate and, with `--redirect`, adds the `http://` to `https://` redirect. It points nginx at `fullchain.pem`, which includes the intermediate certificate; keep it that way.

Renewal is a systemd timer (or cron job) that runs twice a day and renews each certificate well before it expires, about 30 days ahead on a 90-day certificate. Prove it works:

```bash
sudo systemctl list-timers | grep certbot
sudo certbot renew --dry-run
```

Certbot reloads nginx or Apache after a renewal when it installed the certificate with `--nginx` or `--apache`. If you used `certonly`, add a deploy hook, or the server keeps serving the old certificate:

```bash
sudo certbot renew --deploy-hook "systemctl reload nginx"
```

### Other ACME clients

- **Caddy** gets and renews certificates for every site in its configuration with no extra setup, and redirects HTTP to HTTPS on its own. See [Caddy: the two-line HTTPS server](https://getreport.app/guides/caddy-the-two-line-https-server).
- **acme.sh** is a shell-only client with DNS plugins for most providers, handy for wildcards.
- **Traefik** and other reverse proxies have ACME built in.

### Wildcard certificates

For `*.example.com`, use DNS-01. With certbot and a DNS provider plugin (Cloudflare, Route 53, DigitalOcean and many others), renewal stays automatic. Without a plugin you would add the TXT record by hand every time, which defeats the point. A wildcard covers one level, so request `example.com` and `*.example.com` together.

### Rate limits

Let's Encrypt limits issuance to prevent abuse. The ones you might meet, from its rate-limit documentation:

- 50 new certificates per registered domain (such as `example.com` and all its subdomains) every 7 days.
- 5 certificates for the exact same set of names every 7 days.
- 5 failed validations per name, per account, per hour.

Renewals are largely exempt. You only hit these by reissuing in a loop, usually a script or container that requests a new certificate on every start. Test with `--dry-run` or the staging server (`--test-cert`) while you experiment.

## Installing SSL on WordPress

WordPress does not issue certificates; your host or server does. The order:

1. **Get the certificate** for `example.com` and `www.example.com` from the host panel or with certbot, and check that `https://example.com` loads.
2. **Switch WordPress to HTTPS.** In Settings → General, change both WordPress Address and Site Address to `https://`. Since WordPress 5.7, Tools → Site Health offers an "Update your site to use HTTPS" button once HTTPS works, which also rewrites old links in content as they are shown.
3. **Replace old `http://` links in the database** so the change is permanent. With WP-CLI:

   ```bash
   wp search-replace 'http://example.com' 'https://example.com' --skip-columns=guid --dry-run
   ```

   Remove `--dry-run` when the counts look right, and take a backup first.

4. **Redirect `http://` to `https://`** at the server or host ("Force HTTPS"), not with a plugin if you can avoid it.
5. **Check for mixed content**: images, scripts or fonts that theme or page builder settings still load over `http://`. See [mixed content: finding and fixing http:// leftovers](https://getreport.app/guides/mixed-content-after-https).

A plugin that "adds SSL" only rewrites links and adds redirects; it cannot create a certificate. Once the steps above are done, you do not need it.

## Check that it works

> **Free tool:** [SSL checker: check your SSL certificate and TLS](https://getreport.app/tools/ssl-check): Free SSL checker: test certificate expiry and chain, TLS versions, HTTPS redirects, HSTS and mixed content on any site, with the fix for each. No sign-up.

The SSL checker performs a real TLS handshake, reads the certificate your server sends and checks the chain against the public roots. It also tests the `http://` redirect and looks for `http://` files on the page, the two things that keep a new certificate from giving you a clean HTTPS site.

> **Check: Certificate expiry.** When the certificate expires, every browser shows a full-page warning and most visitors leave. Automatic renewals fail silently more often than you would expect.
>
> 1. Renew the certificate now; with Let's Encrypt, run certbot renew and check the auto-renew job's logs.
> 2. Add a monitor so you get an email 14 days before the next expiry.

> **Check: http:// redirects to https://.** Visitors who type your address without https, or follow an old link, land on the unencrypted page. Every one of those visits can be read or altered on the network.
>
> 1. Redirect every http:// URL to the same path on https:// with a 301.
> 2. nginx: return 301 https://$host$request_uri; Apache: RewriteRule in .htaccess; most hosts and Cloudflare have a "Always use HTTPS" switch.

> **Check: No resources load over http://.** Browsers block http:// scripts and stylesheets on an HTTPS page, which breaks layout or features, and upgrade http:// images and media to https, showing them broken when that fails. It usually appears after a move to HTTPS while old absolute URLs stay in the content.
>
> 1. Search and replace http:// with https:// in content, theme and configuration (WordPress: a search-replace plugin covers the database).
> 2. Add Content-Security-Policy: upgrade-insecure-requests as a safety net.

A fresh Let's Encrypt certificate shows about 90 days left. If you check again a few weeks later and it has fewer than 30, renewal is not running: the expiry finding warns under 30 days and fails under 7. Email alerts before expiry are part of monitoring, a funded unlock; until then, re-run the check after any server or DNS change.

## When a paid certificate is worth it

Paying changes nothing visitors see and nothing about the encryption. It makes sense when:

- A contract, tender or compliance rule requires an OV or EV certificate with your company name in it.
- You need a warranty, or a support line from the authority.
- A system cannot automate renewal, such as some appliances, older load balancers or embedded devices. Even then, paid certificates are subject to the same maximum lifetimes (200 days for certificates issued from 15 March 2026), so plan for renewing more often.

For a normal website, a free certificate that renews itself is cheaper and safer than a paid one that someone must remember.

## Common mistakes

- **Only `example.com` on the certificate.** Add `www.example.com` too; visitors reach both.
- **Blocking or redirecting `/.well-known/acme-challenge/` to another host.** Issuance works once by hand, and renewal fails silently later.
- **Using `certonly` without a deploy hook**, so the server keeps the expired certificate in memory.
- **Reissuing on every container start** and hitting the weekly limit. Store the certificates in a volume.
- **Assuming Let's Encrypt will email you before expiry.** It no longer does.

## Questions people ask

### Is Let's Encrypt really free?

Yes. Let's Encrypt charges nothing for certificates, has no paid tier and needs no account beyond what your ACME client creates automatically. It is funded by donations and sponsors through the non-profit Internet Security Research Group. The costs you might see come from hosts that charge for installing it or from your own time; on most hosting it is a switch in the control panel.

### Is Let's Encrypt trusted by all browsers?

Yes. Let's Encrypt's root certificate, ISRG Root X1, is in the trust stores of Chrome, Firefox, Safari, Edge, Android, iOS, Windows and macOS, so visitors see the same secure connection as with any paid certificate. Very old devices, such as Android versions before 7.1.1 that have not been updated, may not trust it, but they also cannot open much of the modern web.

### How long does a Let's Encrypt certificate last?

A Let's Encrypt certificate lasts 90 days today. Let's Encrypt has announced 64 days for certificates issued from 10 February 2027 and 45 days from 16 February 2028, following industry-wide limits. Certbot and most other clients renew about 30 days before expiry on today's certificates, so a working setup renews roughly every 60 days without anyone touching it.

### Can I get a free wildcard SSL certificate?

Yes. Let's Encrypt issues wildcard certificates such as `*.example.com` for free, but only through the DNS-01 challenge, where you prove control by publishing a TXT record. Use an ACME client with a plugin for your DNS provider so renewal stays automatic. A wildcard covers one level of subdomain and not the bare domain, so request both names on one certificate.

### How do I install an SSL certificate on WordPress?

Get the certificate from your host's control panel or with certbot first; WordPress cannot create one. Then set both addresses in Settings → General to `https://`, replace old `http://` links in the database with a search-and-replace, redirect all `http://` requests to `https://` at the server, and check pages for mixed content. Site Health in WordPress 5.7 and later can do the address switch for you.