中文

Glossary

Let's Encrypt (ISRG)

Last verified

Definition

Let's Encrypt is a free, automated, nonprofit certificate authority run by ISRG that issues domain-validated TLS certificates through the ACME protocol.

Let's Encrypt is a certificate authority operated by the Internet Security Research Group (ISRG). It entered public beta on 2015-12-03, added ACMEv2 and wildcard certificates on 2018-03-13, and shut down ACMEv1 on 2021-06-01. It issues only DV certificates, entirely through ACME, using ACME profiles: classic (the default, currently 90 days), tlsserver (45-day certificates since 2026-05-13) and shortlived (six days, or 160 hours). Six-day certificates and IP-address certificates became generally available through the shortlived profile on 2026-01-15.

Why it matters

Its decisions shape much of the web PKI, and several recent ones affect operators directly:

  • OCSP ended: announced 2024-12-05, OCSP URLs removed from new certificates on 2025-05-07 (Must-Staple requests rejected from then), responders shut down on 2025-08-06. It now publishes CRLs.
  • Expiration reminder emails ended on 2025-06-04, so monitoring is your job.
  • The classic profile stopped including the clientAuth EKU on 2026-02-11, and the tlsclient profile was discontinued on 2026-07-08.
  • ISRG's 45-day plan (2025-12-02): classic moves to 64 days with 10-day authorization reuse from 2027-02-10, then 45 days with 7-hour authorization reuse from 2028-02-16.
  • Chains: DST Root CA X3 expired 2021-09-30; the default chain stopped using the ISRG Root X1 cross-sign on 2024-02-08, and that cross-sign expired 2024-09-30. The Generation Y hierarchy (announced 2025-11-24) adds ISRG Root YR (RSA-4096) and ISRG Root YE (ECDSA P-384) with new intermediates, none with clientAuth. As of 2026-06-03 every server-certificate profile issues from Gen Y or ISRG Root X2.

Example

sudo certbot certonly --nginx -d example.com -d www.example.com
sudo certbot renew --dry-run

The dry run confirms that the scheduled renewal job will succeed.

Common misconceptions

  • Free means weaker security. A Let's Encrypt DV certificate provides the same encryption as a paid DV certificate.
  • Let's Encrypt will email me before expiry. Those emails ended on 2025-06-04; use your own monitoring.
  • Certificates always last 90 days. Lifetime depends on the profile and is scheduled to fall to 45 days.

See also