Let’s Encrypt and ACME: Free HTTPS certificates automatically

In short: Let’s Encrypt issues free certificates that a program requests automatically via the ACME protocol and renews every 60 to 90 days.

In more detail: For HTTPS a web server needs a certificate confirming that it really belongs to the domain. This used to cost money and manual work. Let’s Encrypt (a non-profit certificate authority) makes it free and automatic; today HTTPS is standard on almost every site.

In Depth

How it works (ACME)

The ACME protocol automates the process:

1. A client (for example Certbot, acme.sh, Caddy) requests a certificate for example.com.
2. The CA demands proof of control over the domain (challenge).
3. On success it issues the certificate.
4. The client renews it automatically before expiry (certificates are valid briefly, about 90 days, to limit errors and misuse).

Challenge types

• HTTP-01: provide a file at http://domain/.well-known/acme-challenge/…. Simple, but port 80 must be reachable and wildcards do not work.
• DNS-01: set a TXT record in DNS. Needed for wildcard certificates (*.example.com) and for servers without public reachability.
• TLS-ALPN-01: proof in the TLS handshake on port 443.

Setting up

# Example with Certbot and Nginx
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com
sudo certbot renew --dry-run   # test renewal

Caddy obtains certificates automatically without further settings. Many hosts and platforms (Vercel, Netlify, Cloudflare) take care of everything for you.

Notes

Keep an eye on expiry dates (monitoring), store the private key protected, mind the CA’s rate limits (many requests per week are limited, use the staging environment for testing). A certificate only proves that the domain is controlled, not that the operator is reputable. Additionally enable HSTS.

See also: TLS, Certificate, Certificate authorities, HTTPS, Security headers