Certificate authority

Let's Encrypt: free ACME CA, roots and recent changes

Last verified Nov 10, 2026

CCADB CA owner: Internet Security Research Group
Country: US
Country (CCADB): United States of America
ACME: Yes
Free certificates: Yes
Products: DV wildcard multi-domain
Roots: 2
Roots trusted for TLS: Chrome 2 · Mozilla 2 · Apple 2 · Microsoft 2
Intermediates under its roots: 30 (18 valid)
Auditor: BDO International Limited
CAA: letsencrypt.org

Key points

Let's Encrypt is a free certificate authority operated by the Internet Security Research Group (ISRG), a US nonprofit, and issues certificates only through the ACME protocol.
As of November 2026, CCADB shows its roots ISRG Root X1 (RSA 4096, valid until 2035-06-04) and ISRG Root X2 (ECDSA P-384, until 2040-09-17) trusted for TLS by Chrome, Mozilla, Apple and Microsoft.
Let's Encrypt turned off its OCSP responders on 2025-08-06 and has published revocation information only via CRLs since then.
Let's Encrypt stopped sending certificate expiration emails on 2025-06-04, and its default profile stopped including the TLS client authentication EKU on 2026-02-11.
Let's Encrypt's next-generation 'Generation Y' roots, ISRG Root YE and ISRG Root YR, were generated on 2025-09-03 and are cross-signed by ISRG Root X2 and X1.

Let's Encrypt is a free, automated certificate authority: it issues domain-validated TLS certificates at no cost, only through the ACME protocol, so renewal can be fully automated. It is run by the Internet Security Research Group (ISRG), a US nonprofit, and its certificates are trusted by all major browsers and operating systems.

Owner and headquarters

Let's Encrypt is a service of ISRG, a nonprofit based in the United States that funds the CA through sponsorships and donations. There is no paid tier. The CCADB records the CA owner as "Internet Security Research Group".

Root certificates

As of November 2026, CCADB shows two Let's Encrypt roots trusted for TLS by Chrome, Mozilla, Apple and Microsoft: ISRG Root X1 (RSA 4096, valid until 2035-06-04) and ISRG Root X2 (ECDSA P-384, valid until 2040-09-17). Let's Encrypt's chains-of-trust page also lists two newer roots, ISRG Root YE (ECDSA P-384) and ISRG Root YR (RSA 4096), generated on 2025-09-03 and cross-signed by X2 and X1 so they work before root programs include them. Intermediates of this "Generation Y" hierarchy don't include the TLS client authentication EKU.

Certificate products

Let's Encrypt offers only DV certificates: single names, multiple names in one certificate and wildcards (wildcards require the DNS-01 challenge). There are no OV or EV certificates, no code signing and no S/MIME. Usage is limited by published rate limits rather than price.

ACME support

Let's Encrypt was the first CA built around ACME, which the IETF standardized as RFC 8555. Every certificate comes from its ACME API, using clients such as certbot, acme.sh, Caddy or the ones built into hosting panels. HTTP-01, DNS-01 and TLS-ALPN-01 challenges are supported.

Free certificates

All certificates are free. That is the main reason most automated hosting, CDNs and control panels offer Let's Encrypt by default.

Notable incidents and changes

Recent changes matter more to operators than incidents. Let's Encrypt removed OCSP URLs from certificates on 2025-05-07 and switched its OCSP responders off on 2025-08-06, relying on CRLs, which SC-063v4 allowed. It stopped expiration emails on 2025-06-04, so you need your own monitoring. Its default "classic" profile dropped the client authentication EKU on 2026-02-11, and the opt-in "tlsclient" profile ended on 2026-07-08; certificates for mutual TLS clients must come from elsewhere. See the Let's Encrypt timeline for the full history.

CAA records

The CCADB lists 1 CAA issuer domain(s) recognized by the currently valid intermediate certificates of Let's Encrypt. One issue record with any of them lets Let's Encrypt issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them.

Copy-ready record(s) for the first 1 domain(s):

example.com. CAA 0 issue "letsencrypt.org"

Domain	Valid intermediates
`letsencrypt.org`	19

For issuewild, iodef or DNS-provider formats, use the CAA record generator: CAA Generator

Root certificates (CCADB)

Let's Encrypt has 2 root certificate(s) in the CCADB TLS report. Together they have signed 30 intermediate CA certificates, 18 of them still valid.

Roots this CA owner has in the CCADB TLS Server Authentication report, with current status in each root store.

trusted for TLS
included with limits (NotBefore / no TLS bit)
removed or blocked
not included

Root certificate	Key	Expires	Ch	Mo	Ap	MS	Intermediates
ISRG Root X1	RSA 4096	2035-06-04	Included	Included	Included	Included	21 (12)
ISRG Root X2	ECDSA P-384	2040-09-17	Included	Included	Included	Included	9 (6)

Audits

Audit data the CCADB records for the TLS roots of Let's Encrypt. Auditor(s): BDO International Limited. The most recent audit period ended on 2025-08-31.

Audit	Scheme	Period	Statement	Report
Standard audit	WebTrust	2024-09-01 – 2025-08-31	2025-11-06	cpacanada.ca
Network security	WebTrust	2024-09-01 – 2025-08-31	2025-11-06	cpacanada.ca
TLS Baseline Requirements	WebTrust	2024-09-01 – 2025-08-31	2025-11-06	cpacanada.ca

CP/CPS documents

Certificate Policy and Certification Practice Statement links that Let's Encrypt has disclosed in the CCADB for its TLS roots, with effective dates:

CP/CPS: https://letsencrypt.org/documents/isrg-cp-cps-v6.2/ (effective 2026-08-12)
Markdown CP/CPS: https://raw.githubusercontent.com/letsencrypt/cp-cps/refs/tags/v6.2/CP-CPS.md (effective 2026-08-12)
Document repository: https://letsencrypt.org/repository/

Report a certificate problem

To report a mis-issued certificate, a compromised private key or other abuse, use the channels Let's Encrypt lists in the CCADB (replace [at] and [dot] in addresses):

cert-prob-reports[at]letsencrypt[dot]org
https://letsencrypt.org/contact/

Incident reports

CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “Let's Encrypt”:

Bugzilla: incident reports matching “Let's Encrypt”

ACME directories (CCADB)

DV ACME directory URLs that Let's Encrypt has disclosed in the CCADB for its valid certificates:

https://acme-v02.api.letsencrypt.org/directory

FAQ

Is a Let's Encrypt certificate less secure than a paid one?

No. A Let's Encrypt DV certificate uses the same TLS encryption and is trusted by the same browsers as a paid DV certificate. Paid certificates differ in validation level (OV/EV), support, warranties and lifetimes, not in encryption strength.

Does Let's Encrypt still email me before my certificate expires?

No. Let's Encrypt ended expiration notification emails on 2025-06-04. Use automated renewal and an independent expiry monitor instead.

What CAA record allows Let's Encrypt to issue certificates?

Publish example.com. CAA 0 issue "letsencrypt.org". The CCADB lists 1 recognized domain(s) for Let's Encrypt: letsencrypt.org.

Who audits Let's Encrypt?

BDO International Limited, according to the CCADB. The latest TLS Baseline Requirements audit (WebTrust) covers 2024-09-01 to 2025-08-31; the statement is dated 2025-11-06.