# Let's Encrypt vs ZeroSSL vs Google Trust Services (2026)

> The three free ACME certificate authorities compared: lifetimes, account requirements, wildcard support and which to pick as a primary or backup CA.

Source: https://ssl.sh/compare/lets-encrypt-vs-zerossl-vs-google-trust-services/
Last updated: 2026-11-10

For most sites **Let's Encrypt** is the default choice: it needs no account, works with almost every hosting panel and ACME client, and is trusted everywhere. ZeroSSL makes a good second CA if your client supports External Account Binding, and Google Trust Services suits teams on Google Cloud. All three issue free DV certificates, including wildcards via DNS-01.

## At a glance

Let's Encrypt is the only one of the three that needs no account. Comparison as of November 2026:

| | Let's Encrypt | ZeroSSL | Google Trust Services |
|---|---|---|---|
| Price | Free | Free over ACME; paid plans for web UI | Free |
| Account needed | No | Yes, EAB credentials | Yes, Google Cloud project + EAB key |
| Default lifetime | 90 days (64 days from 10 Feb 2027) | 90 days | See Google Cloud docs |
| Shorter options | 45-day `tlsserver`, 160-hour `shortlived` profiles | — | — |
| Wildcards | Yes (DNS-01) | Yes | Yes |
| CAA value | `letsencrypt.org` | see ZeroSSL docs | `pki.goog` |
| Web interface | No | Yes (free plan: 3 certificates) | No (gcloud CLI) |

## Let's Encrypt

Let's Encrypt is the simplest: point certbot, acme.sh, Caddy or your control panel at it and certificates renew on their own. It is also the CA moving fastest towards short lifetimes. Its `classic` profile issues 90-day certificates, the `tlsserver` profile 45-day ones, and the opt-in `shortlived` profile certificates valid for 160 hours. The default drops to 64 days on 10 February 2027 and to 45 days in 2028, so make sure your client renews based on the certificate's lifetime (or ARI), not a fixed 60-day timer.

## ZeroSSL

ZeroSSL issues an unlimited number of free 90-day certificates over ACME at `https://acme.zerossl.com/v2/DV90`, but your client must register with External Account Binding (EAB) credentials from your ZeroSSL account; acme.sh can create them from an email address. Its web interface is handy if you cannot run ACME at all, but the free plan there is limited to 3 certificates. ZeroSSL's certificates chain to Sectigo roots, so a ZeroSSL backup does not share Let's Encrypt's chain.

## Google Trust Services

Google's free public CA is reached through Google Cloud Certificate Manager. You enable the Public CA API in a Google Cloud project, create an EAB key with `gcloud publicca external-account-keys create`, and register your ACME client with it. It suits teams that already manage infrastructure on Google Cloud; for a single small site the set-up is heavier than Let's Encrypt.

## Recommended setup

Run Let's Encrypt as the primary CA and one of the others as a fallback:

1. Use Let's Encrypt as your primary CA.
2. Add ZeroSSL or Google Trust Services as a fallback in your ACME client.
3. Publish CAA records allowing both CAs. Check them with the [CAA checker](https://ssl.sh/tools/caa-checker/) or generate them with the [CAA generator](https://ssl.sh/tools/caa-generator/).
4. Monitor expiry so a failed renewal does not reach visitors; see [automating certificate renewal](https://ssl.sh/learn/automate-certificate-renewal/).

If you need OV, EV or a vendor to support you, none of these will do; see [free vs paid SSL](https://ssl.sh/compare/free-vs-paid-ssl/).