What is Let’s Encrypt?
Author: Domeny.ForSale editorial team Published
In brief: Let’s Encrypt is a free certificate authority that issues certificates enabling HTTPS on a website. These allow a browser to verify the server’s identity for a given domain and establish an encrypted connection. With many hosting providers, you only need to enable the relevant option in the control panel, but you also need to ensure automatic certificate renewal and correct website configuration.
What does a Let’s Encrypt certificate provide?
Let’s Encrypt is run by the nonprofit Internet Security Research Group (ISRG). It operates as a certificate authority: an entity that issues digital certificates trusted by browsers and other software. A certificate binds a domain name to a public key used to secure the connection.
HTTPS is the HTTP protocol secured by TLS — a mechanism for encrypting communications. It protects transmitted data from being read or altered by third parties along the route between the browser and the server. This matters when logging in, submitting a form or placing an order, but also when simply reading a website.
You will still encounter the term “SSL certificate” in hosting plans. In most cases, it means a certificate used with TLS, the modern successor to the obsolete SSL protocol. You do not need to look for a separate product just because your hosting control panel uses the older term.
HTTPS does not confirm that a website’s owner is trustworthy. A phishing website can also have a valid certificate. Let’s Encrypt verifies control over a domain, not a shop’s reliability, the security of its software or a company’s identity.
How are certificates issued and renewed?
Let’s Encrypt issues DV certificates, short for Domain Validation. Before a certificate can be issued, you must demonstrate control over the specified domain. The process is handled by ACME — a protocol that allows software to request and renew certificates automatically.
The most common verification methods are:
- HTTP-01: the software makes a special file available at a specified website address. The validation server must be able to retrieve it over port 80.
- DNS-01: a special TXT record is added to the domain’s DNS, the system that stores its network settings. This method also allows you to obtain a wildcard certificate covering subdomains, such as
*.example.com.
The wildcard *.example.com covers, for example, sklep.example.com, but not the domain example.com itself or the address panel.sklep.example.com. The root domain can be included in the certificate as an additional name.
Certificates have a limited validity period, so automatic renewal is fundamental to how Let’s Encrypt works. You should not rely on a manual calendar reminder to manage them. Check the official Let’s Encrypt documentation for current validity periods, available certificate profiles and issuance limits; you can also check a particular certificate’s expiry date in its details.
How do you enable Let’s Encrypt on your website?
On shared hosting, start with the administration panel. Look for a section labelled “SSL”, “TLS”, “HTTPS” or “Let’s Encrypt”. Check whether the service includes certificate issuance, installation and automatic renewal — the scope of support depends on the provider.
For example, if your blog runs at example.com and www.example.com redirects to it, the certificate should cover both names. The browser first establishes an HTTPS connection to the initial address and only then receives the redirect.
A practical implementation sequence is:
- Check that the domain and the subdomains you use point to the correct server.
- Enable the certificate for all names under which the website should be accessible.
- Open the website using
https://and test its forms, login functionality and resources. - Set HTTPS as the primary address in your content management system and configure a redirect from HTTP.
- Confirm that automatic renewal and error notifications are working.
On your own server, you can use an ACME client, such as Certbot, or a web server with built-in ACME support. The specific commands depend on the operating system and configuration. When automating DNS validation, restrict the permissions of your DNS credentials and protect them from disclosure.
Is a free certificate enough for an online shop or business website?
For a typical blog, business website or online shop, Let’s Encrypt is usually sufficient to secure the HTTPS connection. A free certificate does not inherently mean weaker encryption. Security also depends on the TLS configuration, protection of the private key and keeping the server up to date.
A paid certificate may make sense if you need verification of your organisation’s details, specific provider support or must meet contractual requirements. OV and EV certificates include additional checks on the organisation; Let’s Encrypt does not issue them. Buying a certificate alone does not protect an application against hacking.
Let’s Encrypt issues certificates free of charge, but your hosting provider may charge for managing them. Before choosing a service, check the provider’s pricing and terms, particularly installation and renewal costs.
What should you check if HTTPS is not working correctly?
A browser warning may result from an expired certificate, a missing domain name or an incomplete certificate configuration on the server. After migrating to a new hosting provider, make sure the new server also renews the certificate — automation on the previous server does not take care of this task.
Another problem is mixed content: loading resources over HTTP on a page opened over HTTPS. This can affect images, scripts or stylesheets, for example. The browser may block these resources; you need to correct their addresses in the content, template or application settings.
After enabling HTTPS, check not only the homepage but also the contact form, login panel and checkout process. Finally, enable monitoring of the certificate’s expiry date so that a renewal failure does not go unnoticed.
See also: What are domain names with Polish characters?
Read also
