How to choose and request a Let's Encrypt certificate profile

You choose a Let's Encrypt profile with one client option, such as --preferred-profile tlsserver in Certbot, and then make renewal timing fit that profile's lifetime. classic certificates last 90 days, tlsserver 45 days and shortlived about 6 days.

Profile selection follows the IETF draft on ACME profiles and works with Certbot 4.0+, acme.sh 3.1.2+, lego v5, Caddy 2 (experimental option), Traefik v3, cert-manager 1.18+ and the Nginx ACME module 0.3.0+.

Prerequisites

Profiles change how short-lived certificates are, so renewal must already be automatic.

• An ACME client at or above the versions listed above.
• A scheduler that runs renewal at least daily; for shortlived, at least twice a day is safer.
• Software that does not depend on the certificate's subject Common Name (relevant to tlsserver and shortlived).

Step 1: Compare the profiles

classic stays the default; tlsserver and shortlived are opt-in profiles with shorter lifetimes and fewer certificate fields:

The former tlsclient profile was retired on July 8, 2026, and the classic profile stopped including the TLS Client Authentication EKU on February 11, 2026. Use a private CA for client certificates.

Step 2: Check what the server offers

The ACME directory lists the profiles Let's Encrypt offers in its profiles object:

curl -s https://acme-v02.api.letsencrypt.org/directory | python3 -m json.tool | grep -A6 '"profiles"'

The staging directory at https://acme-staging-v02.api.letsencrypt.org/directory lists the same profiles; use it to test.

Step 3: Configure your client

Each client takes the profile name as a single option or setting.

Certbot 4.0+ (the choice is saved for renewals from 4.1):

sudo certbot certonly --nginx -d example.com --preferred-profile tlsserver

--required-profile fails instead of falling back when the server does not offer the profile.

acme.sh 3.1.2+:

acme.sh --issue --server letsencrypt -d example.com --dns dns_cf --cert-profile tlsserver

lego v5:

lego run --accept-tos --path /etc/lego --dns cloudflare -d example.com --profile tlsserver

Caddy (marked experimental):

example.com {
    tls {
        issuer acme {
            profile tlsserver
        }
    }
}

Traefik v3 static configuration (also set certificatesDuration in hours so renewal timing matches):

certificatesResolvers:
  le:
    acme:
      email: admin@example.com
      storage: /letsencrypt/acme.json
      profile: tlsserver
      certificatesDuration: 1080
      httpChallenge:
        entryPoint: web

cert-manager 1.18+ (spec.acme.profile on the Issuer or ClusterIssuer):

spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    profile: tlsserver

Nginx ACME module 0.3.0+, inside acme_issuer:

profile tlsserver;

Verify

After the next issuance, a tlsserver certificate shows a validity window of 45 days and an empty subject. Confirm the lifetime and the missing CN with the SSL checker, or from any terminal:

curl ssl.sh/example.com
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -dates

The validity calculator shows when renewal should happen.

Automatic renewal

With a shorter profile, renewal has to follow the certificate lifetime or ARI instead of a fixed number of days. Certbot 4.0+ renews when one third of the lifetime remains (one half if the lifetime is under 10 days) and Certbot 4.1+ follows ARI; acme.sh 3.1.4+ and lego v5 follow ARI by default; Caddy follows ARI. Remove any hard-coded "renew 30 days before expiry" settings, which would renew a 45-day certificate on almost every run and are impossible for 6-day certificates. With acme.sh, an explicit --days overrides ARI since 3.1.5, so leave it unset unless you need it. Add the domain to ssl.sh monitoring (in development) so a stalled renewal is caught within days.

Troubleshooting

• account is not permitted to use certificate profile: the profile is not open to your account or environment; check the directory listing and Let's Encrypt announcements.
• unrecognized arguments: --preferred-profile (or similar): the client predates profile support; upgrade it.
• Client shows a next renewal date 60 days out for a 6-day certificate: the client assumes 90-day lifetimes; rely on ARI or set renewal timing explicitly, and verify with monitoring.
• Legacy software reports an empty subject: it reads the CN; update it or stay on classic until February 2027.
• Client certificate authentication stopped working: see client auth EKU removed.
• Too many orders while testing: use the staging directory; see Let's Encrypt rate limits.