Let's Encrypt
Free, automated nonprofit certificate authority issuing TLS certificates via the ACME protocol.
Loved as the go-to free source of automatically issued and renewed TLS certificates,1234 including DNS-validated wildcard certs for self-hosted and homelab setups, with commenters seeing no real free alternative.5678 The most common worry is that the web relies on a single free provider,910 alongside complaints about shorter certificate lifetimes, rate limits and the end of client-auth certificates.111213
Why people recommend it
Automated renewal · 3
Certificates are issued and renewed automatically through tools like Traefik, acme.sh and hosting control panels, with little upkeep.
“Traefik handles the routing and Let's Encrypt cert creation and renewal.”
“The personal site I started with is one certificate for a static site”
Show 1 more
“automatically install and maintain a Let's Encrypt certificate on your behalf”
DNS validation, wildcards · 3
DNS challenges and wildcard certs let self-hosters secure internal services and many subdomains.
“Use DNS validation to get a certificate on your domain from Let's Encrypt.”
Show 1 more
“DNS01 challenge for let's encrypt”
Widely appreciated · 3
Commenters say they love it and credit it with ending the pain of pre-LE SSL/TLS.
“LE has been an amazing resource and every time I setup a new website and get a LE cert I smile.”
“I use Let’s Encrypt. It is an amazing service and I am forever grateful.”
Show 1 more
No free alternative · 1
Other free CAs require accounts, cap free certs or lack free wildcards.
“There really is no alternative to LE.”
Fits cheap stacks · 2
Paired with a small VPS and Dokku, it supports side projects at minimal cost.
“everything behind traefik (with let's e encrypt)”
Caveats and dissent
Single-provider reliance · 2
Commenters warn that depending on one free certificate supplier is risky and want a second source.
“I use Let’s Encrypt. It is an amazing service and I am forever grateful.”
“Obviously I use LE myself and like what they do”
Shorter validity · 1
Shrinking certificate lifetimes push small sites to depend on reliable renewal automation.
“So every small site that took the LE bait needs expensive help to stay online.”
Rate limits · 1
One commenter uses ZeroSSL to avoid LE rate limits and for better support on old Android versions.
“I use them in some cases to avoid the rate limits on LetsEncrypt”
No client auth · 1
New intermediates drop the TLS Client Authentication usage, breaking server-to-server client cert use.
“If I want a client certificate, it sounds like that won't be available any longer from LetsEncrypt”
Subdomain exposure · 1
Per-subdomain certs appear in certificate history, so one commenter uses wildcards to limit leaked details.
“I could use Let's Encrypt wildcard feature '.home.domain.com' and at least limit the private details potentially leaked in certificate history.”
Often compared with
Who recommends it in their own words
Threads where it came up
- 10 Years of Let's Encrypt 5 mentions
- TLS certificates for internal services done right 3 mentions
- Upcoming Changes to Let's Encrypt Certificates 3 mentions
- What I self-host 2 mentions
- Decreasing Certificate Lifetimes to 45 Days 2 mentions
- Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7? 1 mention
Data: let-s-encrypt.json. Quotes are verbatim; the verdict and theme labels are written by a model from these comments, and every clause links to its sources.
All comments 26
“I renew it automatically via DNS.”
“Traefik handles the routing and Let's Encrypt cert creation and renewal.”
“everything behind traefik (with let's e encrypt)”
“I could use Let's Encrypt wildcard feature '.home.domain.com' and at least limit the private details potentially leaked in certificate history.”
“Use Acme.sh / lets encrypt for certs.”
“As someone familiar with LetsEncrypt, makes me feel like I'd slide right in here easily.”
“I use LetsEncrypt with DNS validation to get the certificates.”
“DNS01 challenge for let's encrypt”
“Use DNS validation to get a certificate on your domain from Let's Encrypt.”
“I use them in some cases to avoid the rate limits on LetsEncrypt”
“It uses Let's Encrypt by default.”
“I love Let's Encrypt”
“rsync /etc/letsencrypt/ ssl certificates”
“challenges for DNS e.g. Letsencrypt, I'll use their hooks to update my DNS”
“nginx with letsencrypt wildcard”
“If I want a client certificate, it sounds like that won't be available any longer from LetsEncrypt”
“While I love Let's Encrypt it feels so silly to use a third party”
“There really is no alternative to LE.”
“I believe I can do better checks on who "controls" a domain name than Let's Encrypt.”
“I love Let's Encrypt”
“Obviously I use LE myself and like what they do”
“automatically install and maintain a Let's Encrypt certificate on your behalf”
“I use Let’s Encrypt. It is an amazing service and I am forever grateful.”
“LE has been an amazing resource and every time I setup a new website and get a LE cert I smile.”
“The personal site I started with is one certificate for a static site”
“So every small site that took the LE bait needs expensive help to stay online.”