# What Is Let's Encrypt (ISRG)? Definition and Examples

> Let's Encrypt is a free, automated, nonprofit certificate authority run by ISRG that issues domain-validated TLS certificates through the ACME protocol.

Source: https://ssl.sh/glossary/let-s-encrypt/
Last updated: 2026-11-10

Let's Encrypt is a certificate authority operated by the Internet Security Research Group (ISRG). It entered public beta on 2015-12-03, added ACMEv2 and wildcard certificates on 2018-03-13, and shut down ACMEv1 on 2021-06-01. It issues only DV certificates, entirely through [ACME](https://ssl.sh/glossary/acme/), using [ACME profiles](https://ssl.sh/glossary/acme-profile/): classic (the default, currently 90 days), tlsserver (45-day certificates since 2026-05-13) and shortlived (six days, or 160 hours). Six-day certificates and IP-address certificates became generally available through the shortlived profile on 2026-01-15.

## Why it matters
Its decisions shape much of the web PKI, and several recent ones affect operators directly:

- OCSP ended: announced 2024-12-05, OCSP URLs removed from new certificates on 2025-05-07 (Must-Staple requests rejected from then), responders shut down on 2025-08-06. It now publishes [CRLs](https://ssl.sh/glossary/crl/).
- Expiration reminder emails ended on 2025-06-04, so monitoring is your job.
- The classic profile stopped including the clientAuth EKU on 2026-02-11, and the tlsclient profile was discontinued on 2026-07-08.
- ISRG's 45-day plan (2025-12-02): classic moves to 64 days with 10-day authorization reuse from 2027-02-10, then 45 days with 7-hour authorization reuse from 2028-02-16.
- Chains: DST Root CA X3 expired 2021-09-30; the default chain stopped using the ISRG Root X1 cross-sign on 2024-02-08, and that cross-sign expired 2024-09-30. The Generation Y hierarchy (announced 2025-11-24) adds ISRG Root YR (RSA-4096) and ISRG Root YE (ECDSA P-384) with new intermediates, none with clientAuth. As of 2026-06-03 every server-certificate profile issues from Gen Y or ISRG Root X2.

## Example
```bash
sudo certbot certonly --nginx -d example.com -d www.example.com
sudo certbot renew --dry-run
```

The dry run confirms that the scheduled renewal job will succeed.

## Common misconceptions
- **Free means weaker security.** A Let's Encrypt DV certificate provides the same encryption as a paid DV certificate.
- **Let's Encrypt will email me before expiry.** Those emails ended on 2025-06-04; use your own monitoring.
- **Certificates always last 90 days.** Lifetime depends on the profile and is scheduled to fall to 45 days.

## Related terms

- [ACME](https://ssl.sh/zh/glossary/acme/): ACME 是 IETF 标准协议（RFC 8555），让软件自动向 CA 证明域名控制权，并自动申请、续期和吊销证书。
- [ACME Profile](https://ssl.sh/zh/glossary/acme-profile/): ACME Profile 是 CA 在 ACME 目录中公布的命名证书模板，客户端下单时选择它来决定证书的有效期和内容。
- [ARI](https://ssl.sh/zh/glossary/ari/): ARI 是 ACME 的扩展标准（RFC 9773），由 CA 告诉客户端某张证书应该在哪个时间窗口内续期。
- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。
- [DV 证书](https://ssl.sh/zh/glossary/dv-certificate/): DV 证书是 CA 只验证申请者对域名的控制权、不核实申请者身份的 TLS 证书，签发快且可以完全自动化。
- [短期证书](https://ssl.sh/zh/glossary/short-lived-certificate/): 短期证书是有效期只有几天的 TLS 证书，靠快速过期而不是吊销来限制被盗证书可被滥用的时间。
- [CRL](https://ssl.sh/zh/glossary/crl/): CRL 是由 CA 签名并定期重新发布的证书吊销列表，列出它在证书到期前就已吊销的证书序列号。
- [HTTP-01](https://ssl.sh/zh/glossary/http-01/): HTTP-01 是一种 ACME 验证方式，客户端通过 80 端口以普通 HTTP 提供 CA 指定的令牌内容来证明域名控制权。