{"slug": "let-s-encrypt", "name": "Let's Encrypt", "category": "security", "category_name": "Security and passwords", "description": "Free, automated nonprofit certificate authority issuing TLS certificates via the ACME protocol.", "recommenders": 12, "commenters": 26, "warners": 1, "score": 12.974, "rising": 0.05, "first": "2025-12-01", "latest": "2026-10-16", "why": "Loved as the go-to free source of automatically issued and renewed TLS certificates, including DNS-validated wildcard certs for self-hosted and homelab setups, with commenters seeing no real free alternative.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 12, "neutral": 11, "compare": 2, "warn": 1}, "spark": [0, 7, 0, 0, 0, 0, 1, 0, 1, 0, 1, 2], "listed": true, "loved": ["Automated renewal", "DNS validation, wildcards"], "caveat": "Single-provider reliance", "short_quote": "LE has been an amazing resource and every time I setup a new website and get a LE cert I smile.", "icon": true, "domain": "letsencrypt.org", "github_repo": null, "official_url": "https://letsencrypt.org/", "pricing": "free", "aliases": ["Let's Encrypt"], "verdict": [{"text": "Loved as the go-to free source of automatically issued and renewed TLS certificates,", "cites": [{"id": 739373680, "item_id": 46210855, "url": "https://news.ycombinator.com/item?id=46210855", "by": "joshstrange", "date": "2025-12-09", "stance": "recommend", "quote": "LE has been an amazing resource and every time I setup a new website and get a LE cert I smile.", "excerpt": "I still remember the original announcement around LE and thought \"Great idea, no idea if they'll be able to get buy-in from browsers/etc\", now I use it on all my self-hosted sites and will probably be transitioning my employer over to it when we switch to automated renewal sometime next year. LE has been an amazing resource and every time I setup a new website and get a LE cert I smile. Especially after having lived/", "context": "", "use_case": "TLS certificates for self-hosted sites", "switched_from": "", "story": "10 Years of Let's Encrypt"}, {"id": 739430224, "item_id": 46214389, "url": "https://news.ycombinator.com/item?id=46214389", "by": "Gud", "date": "2025-12-09", "stance": "recommend", "quote": "I use Let\u2019s Encrypt. It is an amazing service and I am forever grateful.", "excerpt": "I use Let\u2019s Encrypt. It is an amazing service and I am forever grateful. However, it is time for a second source of free certificates. It is not good that we rely on one supplier.", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "10 Years of Let's Encrypt"}, {"id": 801839043, "item_id": 50114940, "url": "https://news.ycombinator.com/item?id=50114940", "by": "Balinares", "date": "2026-10-16", "stance": "recommend", "quote": "Traefik handles the routing and Let's Encrypt cert creation and renewal.", "excerpt": "I use Docker Compose so that I don't have to care if the daemon is a single binary or a whole stack: I can use the same setup for everything, and deploying an entire new thing in a maintainable way is quick and easy. Each app's startup/shutdown is managed using the same templated systemd unit, and Traefik handles the routing and Let's Encrypt cert creation and renewal. Basically I want things reliable and low-mainten", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "What I self-host"}, {"id": 738156897, "item_id": 46134806, "url": "https://news.ycombinator.com/item?id=46134806", "by": "wolrah", "date": "2025-12-03", "stance": "neutral", "quote": "The personal site I started with is one certificate for a static site", "excerpt": "> I'm talking about managing two certificates so I can share a static site with a handful of friends. Each one takes about 10 minutes a year to update. The personal site I started with is one certificate for a static site that I use for basically the same thing. It took me 10 minutes to set up in 2016 and I haven't thought about it for a second since then. It just works. > Adding automation means I have to set up a p", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "Decreasing Certificate Lifetimes to 45 Days"}]}, {"text": " including DNS-validated wildcard certs for self-hosted and homelab setups, with commenters seeing no real free alternative.", "cites": [{"id": 781562513, "item_id": 48847657, "url": "https://news.ycombinator.com/item?id=48847657", "by": "Hamuko", "date": "2026-07-09", "stance": "recommend", "quote": "Use DNS validation to get a certificate on your domain from Let's Encrypt.", "excerpt": "I use a registered domain with DNS validation and then CNAMEs that I resolve locally. Basically: 1. Register a domain (\"server.com\") and put it on some public DNS that can do DNS validation with acme.sh. 2. Use DNS validation to get a certificate on your domain from Let's Encrypt. You can just grab a wildcard one (\"*.server.com\"). 3. CNAME all of your services on a public DNS to an internal address (\"email.server.com", "context": "", "use_case": "wildcard TLS certificates", "switched_from": "", "story": "TLS certificates for internal services done right"}, {"id": 756790017, "item_id": 47299376, "url": "https://news.ycombinator.com/item?id=47299376", "by": "acidburnNSA", "date": "2026-03-08", "stance": "neutral", "quote": "nginx with letsencrypt wildcard", "excerpt": "I have something like this, in the same case. I have beefier specs b/c I use it as a daily workstation in addition to running all my stuff. * nginx with letsencrypt wildcard so I have lots of subdomains * No tailscale, just pure wireguard between a few family houses and for remote access * Jellyfin for movies and TV, serving to my Samsung TV via the Tizen jellyfin app * Mopidy holding my music collection, serving to ", "context": "homelab owner", "use_case": "wildcard certificates", "switched_from": "", "story": "My Homelab Setup"}, {"id": 781597248, "item_id": 48849828, "url": "https://news.ycombinator.com/item?id=48849828", "by": "graton", "date": "2026-07-09", "stance": "neutral", "quote": "I use LetsEncrypt with DNS validation to get the certificates.", "excerpt": "I do the same thing. I'm not worried about them seeing my FQDNs. I use the form of hostname.int.example.com for everything inside my home network. None of which is accessible to the outside world. I use LetsEncrypt with DNS validation to get the certificates.", "context": "", "use_case": "home network TLS certificates", "switched_from": "", "story": "TLS certificates for internal services done right"}, {"id": 740502464, "item_id": 46281404, "url": "https://news.ycombinator.com/item?id=46281404", "by": "notherhack", "date": "2025-12-15", "stance": "recommend", "quote": "There really is no alternative to LE.", "excerpt": "The other CAs with a free tier that I'm aware of (zerossl, ssl.com, actalis, google trust, cloudflare) require you to have an account (which means you're at their mercy), and most of them limit the number of free certs you can get to a very small number and don't offer free wildcard certs at all. There really is no alternative to LE.", "context": "", "use_case": "free TLS certificates", "switched_from": "", "story": "Upcoming Changes to Let's Encrypt Certificates"}]}, {"text": " The most common worry is that the web relies on a single free provider,", "cites": [{"id": 739430224, "item_id": 46214389, "url": "https://news.ycombinator.com/item?id=46214389", "by": "Gud", "date": "2025-12-09", "stance": "recommend", "quote": "I use Let\u2019s Encrypt. It is an amazing service and I am forever grateful.", "excerpt": "I use Let\u2019s Encrypt. It is an amazing service and I am forever grateful. However, it is time for a second source of free certificates. It is not good that we rely on one supplier.", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "10 Years of Let's Encrypt"}, {"id": 739448800, "item_id": 46215550, "url": "https://news.ycombinator.com/item?id=46215550", "by": "KronisLV", "date": "2025-12-10", "stance": "recommend", "quote": "Obviously I use LE myself and like what they do", "excerpt": "Cloudflare: \"Oh no, we can't have that much centralization, that's horrible, just think of the impact outages have!\" Let's Encrypt: crickets Obviously I use LE myself and like what they do, and even in the example above some downtime would have less of an impact than Cloudflare would (due to renewals being less time sensitive), I'm just surprised that there aren't like 5 other orgs that do the same at scale, like an ", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "10 Years of Let's Encrypt"}]}, {"text": " alongside complaints about shorter certificate lifetimes, rate limits and the end of client-auth certificates.", "cites": [{"id": 737892288, "item_id": 46118268, "url": "https://news.ycombinator.com/item?id=46118268", "by": "jakeogh", "date": "2025-12-01", "stance": "warn", "quote": "So every small site that took the LE bait needs expensive help to stay online.", "excerpt": "\"This change is being made along with the rest of the industry, as required by the CA/Browser Forum Baseline Requirements, which set the technical requirements that we must follow.\" I dont follow. Why? Why not an hour? A ssl failure is a very effective way to shut down a site. \"you should verify that your automation is compatible with certificates that have shorter validity periods. To ensure your ACME client renews ", "context": "", "use_case": "TLS certificates for small sites", "switched_from": "", "story": "Decreasing Certificate Lifetimes to 45 Days"}, {"id": 775442433, "item_id": 48465152, "url": "https://news.ycombinator.com/item?id=48465152", "by": "matharmin", "date": "2026-06-09", "stance": "compare", "quote": "I use them in some cases to avoid the rate limits on LetsEncrypt", "excerpt": "I use them in some cases to avoid the rate limits on LetsEncrypt, and they have better support for some older platforms (like ancient Android versions), and I'm pretty happy so far. I have a paid account to support them, but it's not a requirement for ACME certs. It works without issue with Kubernetes Certbot, and seamless to switch between ZeroSSL and LetsEncrypt. I can't comment on the EU part though - not that rel", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]"}, {"id": 740568064, "item_id": 46285504, "url": "https://news.ycombinator.com/item?id=46285504", "by": "rswail", "date": "2025-12-15", "stance": "neutral", "quote": "If I want a client certificate, it sounds like that won't be available any longer from LetsEncrypt", "excerpt": "If I want a client certificate, it sounds like that won't be available any longer from LetsEncrypt > These new intermediates do not contain the \u201cTLS Client Authentication\u201d Extended Key Usage due to an upcoming root program requirement. We have previously announced our plans to end TLS Client Authentication starting in February 2026, which will coincide with the switch to the Generation Y hierarchy. So we use this to ", "context": "", "use_case": "client certificates for server-to-server auth", "switched_from": "", "story": "Upcoming Changes to Let's Encrypt Certificates"}]}], "praise": [{"label": "Automated renewal", "summary": "Certificates are issued and renewed automatically through tools like Traefik, acme.sh and hosting control panels, with little upkeep.", "quotes": [{"id": 801839043, "item_id": 50114940, "url": "https://news.ycombinator.com/item?id=50114940", "by": "Balinares", "date": "2026-10-16", "stance": "recommend", "quote": "Traefik handles the routing and Let's Encrypt cert creation and renewal.", "excerpt": "I use Docker Compose so that I don't have to care if the daemon is a single binary or a whole stack: I can use the same setup for everything, and deploying an entire new thing in a maintainable way is quick and easy. Each app's startup/shutdown is managed using the same templated systemd unit, and Traefik handles the routing and Let's Encrypt cert creation and renewal. Basically I want things reliable and low-mainten", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "What I self-host"}, {"id": 738156897, "item_id": 46134806, "url": "https://news.ycombinator.com/item?id=46134806", "by": "wolrah", "date": "2025-12-03", "stance": "neutral", "quote": "The personal site I started with is one certificate for a static site", "excerpt": "> I'm talking about managing two certificates so I can share a static site with a handful of friends. Each one takes about 10 minutes a year to update. The personal site I started with is one certificate for a static site that I use for basically the same thing. It took me 10 minutes to set up in 2016 and I haven't thought about it for a second since then. It just works. > Adding automation means I have to set up a p", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "Decreasing Certificate Lifetimes to 45 Days"}, {"id": 739430786, "item_id": 46214424, "url": "https://news.ycombinator.com/item?id=46214424", "by": "selcuka", "date": "2025-12-09", "stance": "recommend", "quote": "automatically install and maintain a Let's Encrypt certificate on your behalf", "excerpt": "Yeah, fair point. I have not used shared hosting for a long time now (static sites are easy/free to host, and dynamic ones don't play well with shared hosting), so I didn't know the Web.com story. I used DreamHost in the past and they had a configuration option in their control panel to automatically install and maintain a Let's Encrypt certificate on your behalf [1]. If you are stuck with Web.com you may consider us", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "10 Years of Let's Encrypt"}]}, {"label": "DNS validation, wildcards", "summary": "DNS challenges and wildcard certs let self-hosters secure internal services and many subdomains.", "quotes": [{"id": 781562513, "item_id": 48847657, "url": "https://news.ycombinator.com/item?id=48847657", "by": "Hamuko", "date": "2026-07-09", "stance": "recommend", "quote": "Use DNS validation to get a certificate on your domain from Let's Encrypt.", "excerpt": "I use a registered domain with DNS validation and then CNAMEs that I resolve locally. Basically: 1. Register a domain (\"server.com\") and put it on some public DNS that can do DNS validation with acme.sh. 2. Use DNS validation to get a certificate on your domain from Let's Encrypt. You can just grab a wildcard one (\"*.server.com\"). 3. CNAME all of your services on a public DNS to an internal address (\"email.server.com", "context": "", "use_case": "wildcard TLS certificates", "switched_from": "", "story": "TLS certificates for internal services done right"}, {"id": 756790017, "item_id": 47299376, "url": "https://news.ycombinator.com/item?id=47299376", "by": "acidburnNSA", "date": "2026-03-08", "stance": "neutral", "quote": "nginx with letsencrypt wildcard", "excerpt": "I have something like this, in the same case. I have beefier specs b/c I use it as a daily workstation in addition to running all my stuff. * nginx with letsencrypt wildcard so I have lots of subdomains * No tailscale, just pure wireguard between a few family houses and for remote access * Jellyfin for movies and TV, serving to my Samsung TV via the Tizen jellyfin app * Mopidy holding my music collection, serving to ", "context": "homelab owner", "use_case": "wildcard certificates", "switched_from": "", "story": "My Homelab Setup"}, {"id": 781576193, "item_id": 48848512, "url": "https://news.ycombinator.com/item?id=48848512", "by": "raffraffraff", "date": "2026-07-09", "stance": "neutral", "quote": "DNS01 challenge for let's encrypt", "excerpt": "Hmm. I don't really care enough about leaking home network host names because they are all super generic names like 'router', 'laptop', 'tv', 'nas'. So I use my public zone on cloudflare. I just use internal ip addresses (eg: nas.example.com = 10.1.2.3) on the public zone and DNS01 challenge for let's encrypt. Anyone can resolve the ip for any of my hosts, but obviously you'd need to be on the wireguard vpn to hit th", "context": "home network user", "use_case": "TLS certificates", "switched_from": "", "story": "TLS certificates for internal services done right"}]}, {"label": "Widely appreciated", "summary": "Commenters say they love it and credit it with ending the pain of pre-LE SSL/TLS.", "quotes": [{"id": 739373680, "item_id": 46210855, "url": "https://news.ycombinator.com/item?id=46210855", "by": "joshstrange", "date": "2025-12-09", "stance": "recommend", "quote": "LE has been an amazing resource and every time I setup a new website and get a LE cert I smile.", "excerpt": "I still remember the original announcement around LE and thought \"Great idea, no idea if they'll be able to get buy-in from browsers/etc\", now I use it on all my self-hosted sites and will probably be transitioning my employer over to it when we switch to automated renewal sometime next year. LE has been an amazing resource and every time I setup a new website and get a LE cert I smile. Especially after having lived/", "context": "", "use_case": "TLS certificates for self-hosted sites", "switched_from": "", "story": "10 Years of Let's Encrypt"}, {"id": 739430224, "item_id": 46214389, "url": "https://news.ycombinator.com/item?id=46214389", "by": "Gud", "date": "2025-12-09", "stance": "recommend", "quote": "I use Let\u2019s Encrypt. It is an amazing service and I am forever grateful.", "excerpt": "I use Let\u2019s Encrypt. It is an amazing service and I am forever grateful. However, it is time for a second source of free certificates. It is not good that we rely on one supplier.", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "10 Years of Let's Encrypt"}, {"id": 768485008, "item_id": 48030313, "url": "https://news.ycombinator.com/item?id=48030313", "by": "basilikum", "date": "2026-05-05", "stance": "recommend", "quote": "I love Let's Encrypt", "excerpt": "This is the kind of system failure that we need really good and well tested disaster recovery plans for. While not necessary this time, DENIC and any critical infrastructure provider should be able to rebuild their entire infrastructure from scratch in a tolerable amount of time (Rather days than hours in the case of a full rebuild). Importantly the disaster recovery plan has to work without reliance on either the sy", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": ".de TLD offline due to DNSSEC?"}]}, {"label": "No free alternative", "summary": "Other free CAs require accounts, cap free certs or lack free wildcards.", "quotes": [{"id": 740502464, "item_id": 46281404, "url": "https://news.ycombinator.com/item?id=46281404", "by": "notherhack", "date": "2025-12-15", "stance": "recommend", "quote": "There really is no alternative to LE.", "excerpt": "The other CAs with a free tier that I'm aware of (zerossl, ssl.com, actalis, google trust, cloudflare) require you to have an account (which means you're at their mercy), and most of them limit the number of free certs you can get to a very small number and don't offer free wildcard certs at all. There really is no alternative to LE.", "context": "", "use_case": "free TLS certificates", "switched_from": "", "story": "Upcoming Changes to Let's Encrypt Certificates"}]}, {"label": "Fits cheap stacks", "summary": "Paired with a small VPS and Dokku, it supports side projects at minimal cost.", "quotes": [{"id": 739500464, "item_id": 46218779, "url": "https://news.ycombinator.com/item?id=46218779", "by": "chasd00", "date": "2025-12-10", "stance": "recommend", "quote": "I love Let's Encrypt", "excerpt": "I love Let's Encrypt A small VPS + LetsEncrypt + Dokku is a fantastic way to run personal side projects/hustles at minimal cost.", "context": "", "use_case": "TLS certificates for side projects", "switched_from": "", "story": "10 Years of Let's Encrypt"}, {"id": 800391060, "item_id": 50024441, "url": "https://news.ycombinator.com/item?id=50024441", "by": "K0IN", "date": "2026-10-09", "stance": "neutral", "quote": "everything behind traefik (with let's e encrypt)", "excerpt": "TeamSpeak, git backup(I use gittea) to backup public repos, backups in general, my website/blog, game servers, ssh(obv) for local app port forward, litellm as ai bridge to monitor usage, some of my own apps: (notification broker to send messages to my devices using a simple http push), everything behind traefik (with let's e encrypt)", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}]}], "caveats": [{"label": "Single-provider reliance", "summary": "Commenters warn that depending on one free certificate supplier is risky and want a second source.", "quotes": [{"id": 739430224, "item_id": 46214389, "url": "https://news.ycombinator.com/item?id=46214389", "by": "Gud", "date": "2025-12-09", "stance": "recommend", "quote": "I use Let\u2019s Encrypt. It is an amazing service and I am forever grateful.", "excerpt": "I use Let\u2019s Encrypt. It is an amazing service and I am forever grateful. However, it is time for a second source of free certificates. It is not good that we rely on one supplier.", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "10 Years of Let's Encrypt"}, {"id": 739448800, "item_id": 46215550, "url": "https://news.ycombinator.com/item?id=46215550", "by": "KronisLV", "date": "2025-12-10", "stance": "recommend", "quote": "Obviously I use LE myself and like what they do", "excerpt": "Cloudflare: \"Oh no, we can't have that much centralization, that's horrible, just think of the impact outages have!\" Let's Encrypt: crickets Obviously I use LE myself and like what they do, and even in the example above some downtime would have less of an impact than Cloudflare would (due to renewals being less time sensitive), I'm just surprised that there aren't like 5 other orgs that do the same at scale, like an ", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "10 Years of Let's Encrypt"}]}, {"label": "Shorter validity", "summary": "Shrinking certificate lifetimes push small sites to depend on reliable renewal automation.", "quotes": [{"id": 737892288, "item_id": 46118268, "url": "https://news.ycombinator.com/item?id=46118268", "by": "jakeogh", "date": "2025-12-01", "stance": "warn", "quote": "So every small site that took the LE bait needs expensive help to stay online.", "excerpt": "\"This change is being made along with the rest of the industry, as required by the CA/Browser Forum Baseline Requirements, which set the technical requirements that we must follow.\" I dont follow. Why? Why not an hour? A ssl failure is a very effective way to shut down a site. \"you should verify that your automation is compatible with certificates that have shorter validity periods. To ensure your ACME client renews ", "context": "", "use_case": "TLS certificates for small sites", "switched_from": "", "story": "Decreasing Certificate Lifetimes to 45 Days"}]}, {"label": "Rate limits", "summary": "One commenter uses ZeroSSL to avoid LE rate limits and for better support on old Android versions.", "quotes": [{"id": 775442433, "item_id": 48465152, "url": "https://news.ycombinator.com/item?id=48465152", "by": "matharmin", "date": "2026-06-09", "stance": "compare", "quote": "I use them in some cases to avoid the rate limits on LetsEncrypt", "excerpt": "I use them in some cases to avoid the rate limits on LetsEncrypt, and they have better support for some older platforms (like ancient Android versions), and I'm pretty happy so far. I have a paid account to support them, but it's not a requirement for ACME certs. It works without issue with Kubernetes Certbot, and seamless to switch between ZeroSSL and LetsEncrypt. I can't comment on the EU part though - not that rel", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]"}]}, {"label": "No client auth", "summary": "New intermediates drop the TLS Client Authentication usage, breaking server-to-server client cert use.", "quotes": [{"id": 740568064, "item_id": 46285504, "url": "https://news.ycombinator.com/item?id=46285504", "by": "rswail", "date": "2025-12-15", "stance": "neutral", "quote": "If I want a client certificate, it sounds like that won't be available any longer from LetsEncrypt", "excerpt": "If I want a client certificate, it sounds like that won't be available any longer from LetsEncrypt > These new intermediates do not contain the \u201cTLS Client Authentication\u201d Extended Key Usage due to an upcoming root program requirement. We have previously announced our plans to end TLS Client Authentication starting in February 2026, which will coincide with the switch to the Generation Y hierarchy. So we use this to ", "context": "", "use_case": "client certificates for server-to-server auth", "switched_from": "", "story": "Upcoming Changes to Let's Encrypt Certificates"}]}, {"label": "Subdomain exposure", "summary": "Per-subdomain certs appear in certificate history, so one commenter uses wildcards to limit leaked details.", "quotes": [{"id": 799109472, "item_id": 49944342, "url": "https://news.ycombinator.com/item?id=49944342", "by": "weightedreply", "date": "2026-10-03", "stance": "recommend", "quote": "I could use Let's Encrypt wildcard feature '.home.domain.com' and at least limit the private details potentially leaked in certificate history.", "excerpt": "The feature I don't want to pay for but would be nice to have: deeper level proxied wildcards. > If you want to proxy a wildcard DNS record on a deeper level like .www.mycoolwebpage.xyz you can subscribe to Cloudflare Advanced Certificate Manager and get a certificate that is covering that wildcard \u00b9 \u00b2 When building out services in my smart home, I started with something like 'home.domain.com'. I used Let's Encrypt f", "context": "smart home self-hoster", "use_case": "TLS certificates for home services", "switched_from": "", "story": "Cloudflare opens more Enterprise-only features to all customers"}]}], "who": [{"by": "binarin", "context": "self-hoster", "url": "https://news.ycombinator.com/item?id=50115458", "date": "2026-10-16"}, {"by": "weightedreply", "context": "smart home self-hoster", "url": "https://news.ycombinator.com/item?id=49944342", "date": "2026-10-03"}, {"by": "8by3", "context": "runs on-prem infrastructure", "url": "https://news.ycombinator.com/item?id=49565716", "date": "2026-09-04"}, {"by": "raffraffraff", "context": "home network user", "url": "https://news.ycombinator.com/item?id=48848512", "date": "2026-07-09"}, {"by": "collinmanderson", "context": "migrates websites between servers", "url": "https://news.ycombinator.com/item?id=47820809", "date": "2026-04-18"}, {"by": "acidburnNSA", "context": "homelab owner", "url": "https://news.ycombinator.com/item?id=47299376", "date": "2026-03-08"}], "tags": ["for self-hosters", "for homelabs", "for side projects", "with reverse proxies", "for wildcard certs"], "use_cases": ["tls certificates", "tls certificates for internal hosts", "tls certificates for home services", "certificates", "home network tls certificates", "wildcard tls certificates"], "compared": [{"slug": "cloudflare", "name": "Cloudflare", "co": 7, "switched_from": 0, "switched_to": 1}, {"slug": "acme-sh", "name": "acme.sh", "co": 4, "switched_from": 0, "switched_to": 0}, {"slug": "zerossl", "name": "ZeroSSL", "co": 4, "switched_from": 0, "switched_to": 0}, {"slug": "traefik", "name": "Traefik", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "wireguard", "name": "WireGuard", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "tailscale", "name": "Tailscale", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "nginx", "name": "nginx", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=46208962", "title": "10 Years of Let's Encrypt", "mentions": 5}, {"url": "https://news.ycombinator.com/item?id=48846995", "title": "TLS certificates for internal services done right", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=46279241", "title": "Upcoming Changes to Let's Encrypt Certificates", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=50109715", "title": "What I self-host", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=46117126", "title": "Decreasing Certificate Lifetimes to 45 Days", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49985548", "title": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {"warn": 1, "neutral": 2, "recommend": 7, "compare": 1}, "2026-01": {}, "2026-02": {}, "2026-03": {"neutral": 2}, "2026-04": {"neutral": 1}, "2026-05": {"recommend": 1, "neutral": 1}, "2026-06": {"compare": 1}, "2026-07": {"recommend": 1, "neutral": 3}, "2026-08": {}, "2026-09": {"recommend": 1}, "2026-10": {"recommend": 2, "neutral": 2}}, "quotes": [{"id": 801847328, "item_id": 50115458, "url": "https://news.ycombinator.com/item?id=50115458", "by": "binarin", "date": "2026-10-16", "stance": "neutral", "quote": "I renew it automatically via DNS.", "excerpt": "I renew it automatically via DNS. But as I use Cloudflare for DNS, and it doesn't allow to precisely control access to subdomains, I use a separate locked down VM that is only responsible for issuance and makes the resulting certs available for download.", "context": "self-hoster", "use_case": "TLS certificates for internal hosts", "switched_from": "", "story": "What I self-host"}, {"id": 801839043, "item_id": 50114940, "url": "https://news.ycombinator.com/item?id=50114940", "by": "Balinares", "date": "2026-10-16", "stance": "recommend", "quote": "Traefik handles the routing and Let's Encrypt cert creation and renewal.", "excerpt": "I use Docker Compose so that I don't have to care if the daemon is a single binary or a whole stack: I can use the same setup for everything, and deploying an entire new thing in a maintainable way is quick and easy. Each app's startup/shutdown is managed using the same templated systemd unit, and Traefik handles the routing and Let's Encrypt cert creation and renewal. Basically I want things reliable and low-mainten", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "What I self-host"}, {"id": 800391060, "item_id": 50024441, "url": "https://news.ycombinator.com/item?id=50024441", "by": "K0IN", "date": "2026-10-09", "stance": "neutral", "quote": "everything behind traefik (with let's e encrypt)", "excerpt": "TeamSpeak, git backup(I use gittea) to backup public repos, backups in general, my website/blog, game servers, ssh(obv) for local app port forward, litellm as ai bridge to monitor usage, some of my own apps: (notification broker to send messages to my devices using a simple http push), everything behind traefik (with let's e encrypt)", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 799109472, "item_id": 49944342, "url": "https://news.ycombinator.com/item?id=49944342", "by": "weightedreply", "date": "2026-10-03", "stance": "recommend", "quote": "I could use Let's Encrypt wildcard feature '.home.domain.com' and at least limit the private details potentially leaked in certificate history.", "excerpt": "The feature I don't want to pay for but would be nice to have: deeper level proxied wildcards. > If you want to proxy a wildcard DNS record on a deeper level like .www.mycoolwebpage.xyz you can subscribe to Cloudflare Advanced Certificate Manager and get a certificate that is covering that wildcard \u00b9 \u00b2 When building out services in my smart home, I started with something like 'home.domain.com'. I used Let's Encrypt f", "context": "smart home self-hoster", "use_case": "TLS certificates for home services", "switched_from": "", "story": "Cloudflare opens more Enterprise-only features to all customers"}, {"id": 793051458, "item_id": 49565716, "url": "https://news.ycombinator.com/item?id=49565716", "by": "8by3", "date": "2026-09-04", "stance": "recommend", "quote": "Use Acme.sh / lets encrypt for certs.", "excerpt": "I refuse to give my data, to yet another company trying to control and centralize the internet. For their \"Free\" service. Instead, I pay money to run a VM with DDOS protection on vultr, to guard my infrastructure I run on prem. Use Acme.sh / lets encrypt for certs. Use bunny.net for CDN which also has some basic protections.", "context": "runs on-prem infrastructure", "use_case": "TLS certificates", "switched_from": "", "story": "Ask HN: Do all of you use Cloudflare for preventing DDoS, Bot and more attacks?"}, {"id": 785189953, "item_id": 49074372, "url": "https://news.ycombinator.com/item?id=49074372", "by": "dpoloncsak", "date": "2026-07-27", "stance": "neutral", "quote": "As someone familiar with LetsEncrypt, makes me feel like I'd slide right in here easily.", "excerpt": "Poked around a bit..excited to see where this goes. Just a quick note, Under \"Get help from the community > Disucssions\", there's a 404 to https://github.com/letsseal/letsseal/discussions . The idea makes sense in principle I think, and but I'll be chewing on it a bit, haha. Seems like a solid standard, but you know how standards go.... (Relevant XKCD: https://xkcd.com/927/) I like that you kept a lot of the same com", "context": "", "use_case": "certificates", "switched_from": "", "story": "Show HN: Let's Seal \u2013 Let's Encrypt for document signing, free and self-hosted"}, {"id": 781597248, "item_id": 48849828, "url": "https://news.ycombinator.com/item?id=48849828", "by": "graton", "date": "2026-07-09", "stance": "neutral", "quote": "I use LetsEncrypt with DNS validation to get the certificates.", "excerpt": "I do the same thing. I'm not worried about them seeing my FQDNs. I use the form of hostname.int.example.com for everything inside my home network. None of which is accessible to the outside world. I use LetsEncrypt with DNS validation to get the certificates.", "context": "", "use_case": "home network TLS certificates", "switched_from": "", "story": "TLS certificates for internal services done right"}, {"id": 781576193, "item_id": 48848512, "url": "https://news.ycombinator.com/item?id=48848512", "by": "raffraffraff", "date": "2026-07-09", "stance": "neutral", "quote": "DNS01 challenge for let's encrypt", "excerpt": "Hmm. I don't really care enough about leaking home network host names because they are all super generic names like 'router', 'laptop', 'tv', 'nas'. So I use my public zone on cloudflare. I just use internal ip addresses (eg: nas.example.com = 10.1.2.3) on the public zone and DNS01 challenge for let's encrypt. Anyone can resolve the ip for any of my hosts, but obviously you'd need to be on the wireguard vpn to hit th", "context": "home network user", "use_case": "TLS certificates", "switched_from": "", "story": "TLS certificates for internal services done right"}, {"id": 781562513, "item_id": 48847657, "url": "https://news.ycombinator.com/item?id=48847657", "by": "Hamuko", "date": "2026-07-09", "stance": "recommend", "quote": "Use DNS validation to get a certificate on your domain from Let's Encrypt.", "excerpt": "I use a registered domain with DNS validation and then CNAMEs that I resolve locally. Basically: 1. Register a domain (\"server.com\") and put it on some public DNS that can do DNS validation with acme.sh. 2. Use DNS validation to get a certificate on your domain from Let's Encrypt. You can just grab a wildcard one (\"*.server.com\"). 3. CNAME all of your services on a public DNS to an internal address (\"email.server.com", "context": "", "use_case": "wildcard TLS certificates", "switched_from": "", "story": "TLS certificates for internal services done right"}, {"id": 775442433, "item_id": 48465152, "url": "https://news.ycombinator.com/item?id=48465152", "by": "matharmin", "date": "2026-06-09", "stance": "compare", "quote": "I use them in some cases to avoid the rate limits on LetsEncrypt", "excerpt": "I use them in some cases to avoid the rate limits on LetsEncrypt, and they have better support for some older platforms (like ancient Android versions), and I'm pretty happy so far. I have a paid account to support them, but it's not a requirement for ACME certs. It works without issue with Kubernetes Certbot, and seamless to switch between ZeroSSL and LetsEncrypt. I can't comment on the EU part though - not that rel", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]"}, {"id": 769412401, "item_id": 48088275, "url": "https://news.ycombinator.com/item?id=48088275", "by": "eric_trackjs", "date": "2026-05-10", "stance": "neutral", "quote": "It uses Let's Encrypt by default.", "excerpt": "I'm working on https://www.certkit.io. It started as a solution to handle TLS certificate automation for my other SaaS products, but we realized other people who run on-prem workloads might get something out of it. It uses Let's Encrypt by default. We use delegated DNS to handle ACME challenge validation (we run the DNS, you just CNAME to us). This means you don't need to give us DNS credentials or anything. And for ", "context": "", "use_case": "certificate issuance", "switched_from": "", "story": "Ask HN: What Are You Working On? (May 2026)"}, {"id": 768485008, "item_id": 48030313, "url": "https://news.ycombinator.com/item?id=48030313", "by": "basilikum", "date": "2026-05-05", "stance": "recommend", "quote": "I love Let's Encrypt", "excerpt": "This is the kind of system failure that we need really good and well tested disaster recovery plans for. While not necessary this time, DENIC and any critical infrastructure provider should be able to rebuild their entire infrastructure from scratch in a tolerable amount of time (Rather days than hours in the case of a full rebuild). Importantly the disaster recovery plan has to work without reliance on either the sy", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": ".de TLD offline due to DNSSEC?"}, {"id": 765132946, "item_id": 47820809, "url": "https://news.ycombinator.com/item?id=47820809", "by": "collinmanderson", "date": "2026-04-18", "stance": "neutral", "quote": "rsync /etc/letsencrypt/ ssl certificates", "excerpt": "I just want to point out this guide uses many of the same tasks I use when migrating websites between servers while minimizing downtown. - reduce dns ttl (if not doing an ip swap) - rsync website files - rsync /etc/letsencrypt/ ssl certificates - copy over database (if writes don't happen often and database is small enough, this can be done without replica, just go read_only during migration) - test new server by put", "context": "migrates websites between servers", "use_case": "SSL certificates", "switched_from": "", "story": "Migrating from DigitalOcean to Hetzner: From $1,432 to $233 With Zero Downtime"}, {"id": 760304626, "item_id": 47519039, "url": "https://news.ycombinator.com/item?id=47519039", "by": "Adachi91", "date": "2026-03-25", "stance": "neutral", "quote": "challenges for DNS e.g. Letsencrypt, I'll use their hooks to update my DNS", "excerpt": "I've been running BIND for quite a long time now, and I've been very happy with it, very few issues other than my own folly, since I'm not on a static IP in the past 15 years my IP has changed 4 times (1 time due to a router change, 3 times due to Comcast outages), I didn't catch the last IP swap for over a month. Which brings me to a rather big gripe about other resolvers not respecting TTL, 70% of https://www.whats", "context": "", "use_case": "DNS challenge certificates", "switched_from": "", "story": "You Can Run a DNS Server"}, {"id": 756790017, "item_id": 47299376, "url": "https://news.ycombinator.com/item?id=47299376", "by": "acidburnNSA", "date": "2026-03-08", "stance": "neutral", "quote": "nginx with letsencrypt wildcard", "excerpt": "I have something like this, in the same case. I have beefier specs b/c I use it as a daily workstation in addition to running all my stuff. * nginx with letsencrypt wildcard so I have lots of subdomains * No tailscale, just pure wireguard between a few family houses and for remote access * Jellyfin for movies and TV, serving to my Samsung TV via the Tizen jellyfin app * Mopidy holding my music collection, serving to ", "context": "homelab owner", "use_case": "wildcard certificates", "switched_from": "", "story": "My Homelab Setup"}, {"id": 740568064, "item_id": 46285504, "url": "https://news.ycombinator.com/item?id=46285504", "by": "rswail", "date": "2025-12-15", "stance": "neutral", "quote": "If I want a client certificate, it sounds like that won't be available any longer from LetsEncrypt", "excerpt": "If I want a client certificate, it sounds like that won't be available any longer from LetsEncrypt > These new intermediates do not contain the \u201cTLS Client Authentication\u201d Extended Key Usage due to an upcoming root program requirement. We have previously announced our plans to end TLS Client Authentication starting in February 2026, which will coincide with the switch to the Generation Y hierarchy. So we use this to ", "context": "", "use_case": "client certificates for server-to-server auth", "switched_from": "", "story": "Upcoming Changes to Let's Encrypt Certificates"}, {"id": 740505104, "item_id": 46281569, "url": "https://news.ycombinator.com/item?id=46281569", "by": "parhamn", "date": "2025-12-15", "stance": "recommend", "quote": "While I love Let's Encrypt it feels so silly to use a third party", "excerpt": "Given certificate issuance basically ended up being \"do you control the DNS for this domain\", I feel like all of it could've been so much simpler if it was designed like that from day one. While I love Let's Encrypt it feels so silly to use a third party to verify I can generate a Cloudflare API key (even .well-known is effectively \"can you run a webserver on said dns entry\"). Edit: TIL about https://en.wikipedia.org", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "Upcoming Changes to Let's Encrypt Certificates"}, {"id": 740502464, "item_id": 46281404, "url": "https://news.ycombinator.com/item?id=46281404", "by": "notherhack", "date": "2025-12-15", "stance": "recommend", "quote": "There really is no alternative to LE.", "excerpt": "The other CAs with a free tier that I'm aware of (zerossl, ssl.com, actalis, google trust, cloudflare) require you to have an account (which means you're at their mercy), and most of them limit the number of free certs you can get to a very small number and don't offer free wildcard certs at all. There really is no alternative to LE.", "context": "", "use_case": "free TLS certificates", "switched_from": "", "story": "Upcoming Changes to Let's Encrypt Certificates"}, {"id": 739513313, "item_id": 46219582, "url": "https://news.ycombinator.com/item?id=46219582", "by": "1vuio0pswjnm7", "date": "2025-12-10", "stance": "compare", "quote": "I believe I can do better checks on who \"controls\" a domain name than Let's Encrypt.", "excerpt": "I dont use a popular browser to make TCP/UDP connections or HTTP requests over the internet This group https://cabforum.org/about/membership/members/ has no control over the software I use I believe I can do better checks on who \"controls\" a domain name than Let's Encrypt. If I am the CA then I dont \"trust\" ad/tracking servers. But popular browsers do. Third party CAs are happy to take money from the people behind th", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "Linux CVEs, more than you ever wanted to know"}, {"id": 739500464, "item_id": 46218779, "url": "https://news.ycombinator.com/item?id=46218779", "by": "chasd00", "date": "2025-12-10", "stance": "recommend", "quote": "I love Let's Encrypt", "excerpt": "I love Let's Encrypt A small VPS + LetsEncrypt + Dokku is a fantastic way to run personal side projects/hustles at minimal cost.", "context": "", "use_case": "TLS certificates for side projects", "switched_from": "", "story": "10 Years of Let's Encrypt"}, {"id": 739448800, "item_id": 46215550, "url": "https://news.ycombinator.com/item?id=46215550", "by": "KronisLV", "date": "2025-12-10", "stance": "recommend", "quote": "Obviously I use LE myself and like what they do", "excerpt": "Cloudflare: \"Oh no, we can't have that much centralization, that's horrible, just think of the impact outages have!\" Let's Encrypt: crickets Obviously I use LE myself and like what they do, and even in the example above some downtime would have less of an impact than Cloudflare would (due to renewals being less time sensitive), I'm just surprised that there aren't like 5 other orgs that do the same at scale, like an ", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "10 Years of Let's Encrypt"}, {"id": 739430786, "item_id": 46214424, "url": "https://news.ycombinator.com/item?id=46214424", "by": "selcuka", "date": "2025-12-09", "stance": "recommend", "quote": "automatically install and maintain a Let's Encrypt certificate on your behalf", "excerpt": "Yeah, fair point. I have not used shared hosting for a long time now (static sites are easy/free to host, and dynamic ones don't play well with shared hosting), so I didn't know the Web.com story. I used DreamHost in the past and they had a configuration option in their control panel to automatically install and maintain a Let's Encrypt certificate on your behalf [1]. If you are stuck with Web.com you may consider us", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "10 Years of Let's Encrypt"}, {"id": 739430224, "item_id": 46214389, "url": "https://news.ycombinator.com/item?id=46214389", "by": "Gud", "date": "2025-12-09", "stance": "recommend", "quote": "I use Let\u2019s Encrypt. It is an amazing service and I am forever grateful.", "excerpt": "I use Let\u2019s Encrypt. It is an amazing service and I am forever grateful. However, it is time for a second source of free certificates. It is not good that we rely on one supplier.", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "10 Years of Let's Encrypt"}, {"id": 739373680, "item_id": 46210855, "url": "https://news.ycombinator.com/item?id=46210855", "by": "joshstrange", "date": "2025-12-09", "stance": "recommend", "quote": "LE has been an amazing resource and every time I setup a new website and get a LE cert I smile.", "excerpt": "I still remember the original announcement around LE and thought \"Great idea, no idea if they'll be able to get buy-in from browsers/etc\", now I use it on all my self-hosted sites and will probably be transitioning my employer over to it when we switch to automated renewal sometime next year. LE has been an amazing resource and every time I setup a new website and get a LE cert I smile. Especially after having lived/", "context": "", "use_case": "TLS certificates for self-hosted sites", "switched_from": "", "story": "10 Years of Let's Encrypt"}, {"id": 738156897, "item_id": 46134806, "url": "https://news.ycombinator.com/item?id=46134806", "by": "wolrah", "date": "2025-12-03", "stance": "neutral", "quote": "The personal site I started with is one certificate for a static site", "excerpt": "> I'm talking about managing two certificates so I can share a static site with a handful of friends. Each one takes about 10 minutes a year to update. The personal site I started with is one certificate for a static site that I use for basically the same thing. It took me 10 minutes to set up in 2016 and I haven't thought about it for a second since then. It just works. > Adding automation means I have to set up a p", "context": "", "use_case": "TLS certificates", "switched_from": "", "story": "Decreasing Certificate Lifetimes to 45 Days"}, {"id": 737892288, "item_id": 46118268, "url": "https://news.ycombinator.com/item?id=46118268", "by": "jakeogh", "date": "2025-12-01", "stance": "warn", "quote": "So every small site that took the LE bait needs expensive help to stay online.", "excerpt": "\"This change is being made along with the rest of the industry, as required by the CA/Browser Forum Baseline Requirements, which set the technical requirements that we must follow.\" I dont follow. Why? Why not an hour? A ssl failure is a very effective way to shut down a site. \"you should verify that your automation is compatible with certificates that have shorter validity periods. To ensure your ACME client renews ", "context": "", "use_case": "TLS certificates for small sites", "switched_from": "", "story": "Decreasing Certificate Lifetimes to 45 Days"}]}