Is the certificate really free and trusted?

Yes. Let's Encrypt is a nonprofit certificate authority run by ISRG. Its certificates are free and trusted by every current browser and operating system. They are domain-validated (DV): they prove control of the domain, not the identity of a company.

Can I get a wildcard certificate?

Yes. Enter *.example.com (usually together with example.com) and choose DNS TXT record. Let's Encrypt only validates wildcard names through DNS, so you add one TXT record per name at _acme-challenge.example.com; both values live under the same name.

Is it safe to get a certificate on a website?

On this page the private key is generated by your browser's WebCrypto implementation and stays in the page. The browser talks to Let's Encrypt directly; ssl.sh never receives the key or the certificate request. If your policy requires keys to be generated on the server, use Certbot or acme.sh there instead.

How long is the certificate valid, and how do I renew it?

90 days today; Let's Encrypt shortens its default to 64 days on February 10, 2027 and 45 days on February 16, 2028. To renew by hand, run this page again before expiry. On a server you control, automatic renewal with Certbot or acme.sh is safer; the setup command generator writes the commands.

Why did validation fail?

Usually the TXT record had not propagated yet, the file was not reachable over plain HTTP on port 80, a firewall or CDN blocked /.well-known/acme-challenge/, or a CAA record does not allow letsencrypt.org. Run Check first: a failed validation cancels the order and counts toward Let's Encrypt's limit of 5 failures per name per hour.

Free SSL Certificate: Get Let's Encrypt in Your Browser

This page is a free SSL certificate generator: an ACME client that runs entirely in your browser and gets a real, browser-trusted certificate from Let's Encrypt. Use it when you cannot run Certbot on the server: shared hosting, a CDN or cloud console that asks you to upload a certificate, a router or NAS, or a one-off test. On servers you control, prefer automatic renewal with the setup command generator.

How it works

Enter the domain names, for example example.com www.example.com, or example.com *.example.com for a wildcard.
Choose the validation method: an HTTP file or a DNS TXT record (see the table below).
Create the order. Your browser creates a Let's Encrypt account key and an order, and shows what to publish for each name.
Publish the file or TXT record, then click Check. ssl.sh looks up the record at your domain's authoritative DNS servers, or fetches the file over HTTP, and marks each name as found or missing.
Verify and issue. Let's Encrypt validates every name. The page then generates the private key and CSR, finalises the order and downloads the certificate chain.
Download the full chain and the private key, and install them.

If you close the tab while waiting for DNS, open the page again: it offers to continue the unfinished order, which Let's Encrypt keeps for about a week.

HTTP file or DNS record?

HTTP validation suits a site that is already online; DNS validation works for any domain whose DNS you can edit, including wildcards.

	HTTP file (http-01)	DNS TXT record (dns-01)
What you publish	a file at `http://<name>/.well-known/acme-challenge/<token>`	a TXT record at `_acme-challenge.<name>`
Needs	the name resolving to a web server reachable on port 80	access to the DNS zone
Wildcards	not possible	required for `*.example.com`
Typical wait	none after upload	seconds to minutes, depending on the DNS provider
Good for	a running site on shared hosting	CDNs, internal hosts, servers without port 80

Let's Encrypt follows HTTP redirects to HTTPS during HTTP validation, so a site that redirects everything to HTTPS still works. A login page, a WAF rule or a CDN that answers /.well-known/acme-challenge/ itself does not.

What you get

File	Contents	Use it for
`example.com.fullchain.pem`	server certificate followed by the intermediate	Nginx `ssl_certificate`, Apache 2.4.8+ `SSLCertificateFile`, HAProxy, most panels
`example.com.key`	unencrypted PKCS #8 private key (ECDSA P-256 or RSA 2048)	`ssl_certificate_key`, `SSLCertificateKeyFile`, the "private key" box of a panel
`example.com.crt` and `example.com.chain.pem`	the certificate and the chain as separate files	older Apache versions and panels with a separate "CA bundle" field

For IIS, Azure or Java, combine the files into a PFX with the PEM to PFX converter. The TLS config generator writes the matching server configuration, and the SSL checker confirms the installation and the chain.

What goes where

Data	Where it goes
Certificate private key	generated in the page with WebCrypto; never stored, never uploaded
Certificate request (CSR) and order	from your browser straight to Let's Encrypt
Let's Encrypt account key	generated in the page and kept in this browser's localStorage so an order can be resumed
Domain names and challenge token	sent to ssl.sh only when you click Check, for the DNS or HTTP pre-check

Because the account key stays in your browser, clearing site data simply means the next order uses a new account. Nothing is lost except the ability to resume an unfinished order.

Renewal and certificate lifetimes

Let's Encrypt certificates are valid for 90 days today. The default drops to 64 days on February 10, 2027 and to 45 days on February 16, 2028, in line with the 47-day timeline. Let's Encrypt also stopped sending expiry reminder emails on June 4, 2025. A certificate obtained by hand therefore has to be renewed by hand, more and more often, and nobody reminds you.

On a server you control, set up Certbot or acme.sh once and let it renew in the background. Where you can only upload certificates, put a reminder in your calendar for when two thirds of the lifetime has passed (day 60 of a 90-day certificate), or use the validity calculator to see when the next one is due.

Limits and common errors

Rate limits: Let's Encrypt allows 5 certificates for the same set of names every 7 days and 5 failed validations per name per hour. See Let's Encrypt rate limit errors. Use the staging option to rehearse.
CAA: if your domain has CAA records, one of them must allow letsencrypt.org. See CAA record prevents issuance or check with the CAA checker.
Port 80 timeouts during HTTP validation: open port 80 in the firewall and cloud security group, or switch to DNS. See timeout during connect.
NXDOMAIN or wrong TXT value: the record is missing, still propagating, or was entered with the domain twice (_acme-challenge.example.com.example.com). See DNS problem: NXDOMAIN.

The protocol behind all this is explained in How ACME works.

Free SSL certificate