HTTP-01 or DNS-01?
ACME is the protocol Let’s Encrypt and other CAs use to check automatically that you control a domain. There are two common ways.
- HTTP-01: the client puts a file under
/.well-known/acme-challenge/, and the CA fetches it over port 80. Simplest when the server is reachable from the internet. No wildcards. - DNS-01: the client creates a TXT record
_acme-challenge.<domain>. Also works for internal servers without public access and is mandatory for wildcards (*.example.com). For automatic renewal the client needs access to your DNS provider’s API.
Tip for DNS providers without an API: create _acme-challenge.example.com once as a CNAME to a name in a zone with an API (e.g. at Cloudflare). The client then writes there and your main zone stays untouched.
Which client?
- certbot: the classic from the EFF, in every Linux distribution. Sets up renewal via a systemd timer itself.
- acme.sh: a pure shell script without dependencies, over 150 DNS providers. Ideal for routers, NAS and containers.
- lego: a single Go binary, good for scripts and CI.
- win-acme: for Windows and IIS. Binds the certificate in IIS directly and creates a scheduled task.
Lifetimes and limits
Let’s Encrypt certificates are valid for 90 days; clients renew after about 60 days. Let’s Encrypt is shortening lifetimes step by step to 45 days by February 2028; from March 2029 an industry-wide maximum of 47 days applies. If you automate, you won’t notice. Try new setups in the test environment first: Let’s Encrypt allows only five identical certificates per set of domains per week, and failed validations are limited too.
If a CAA record blocks the chosen CA, issuance fails; the pre-check above shows this. Afterwards, generate the matching server configuration in the TLS configuration generator and verify the result in the SSL check.
FAQ
Is Let’s Encrypt really free and suitable for companies?
Yes. The certificates are domain validated (DV), like most commercial standard certificates, and accepted by all browsers. What is missing is OV/EV company information and a support contract.
Why ZeroSSL or Google instead of Let’s Encrypt?
As a second CA for emergencies, because of different limits or because a policy requires several providers. Both are free but need External Account Binding (EAB) with an account.
Do I need port 80 even though I only offer HTTPS?
For HTTP-01, yes; the CA always validates via http:// on port 80. The server can then simply redirect to HTTPS there. If you cannot or do not want to open port 80, use DNS-01.
ECDSA or RSA?
ECDSA P-256 is smaller and faster and supported by all current clients. Use RSA 2048 only if very old devices need access.
Where do I enter my API token?
Not here. The commands contain placeholders like