letsencrypt.org No paid content found

Let's Encrypt is a project of the Internet Security Research Group (ISRG), a 501(c)(3) public benefit organization focused on making the Internet more secure and private. ISRG also operates two sibling projects alongside Let's Encrypt, and its annual report is the best place to see progress across all of that work.

The organization behind Let's Encrypt

ISRG is a nonprofit. That structure matters for how Let's Encrypt works in practice: the certificates are free, and the stated purpose is broad access to HTTPS encryption rather than a commercial product.

Let's Encrypt describes itself as "a Certificate Authority that provides free TLS certificates, making it easy for websites to enable HTTPS encryption and create a more secure Internet for everyone." The homepage frames the scale of that mission as "a nonprofit providing free TLS certificates to more than 700M websites."

So the chain of responsibility is:

• ISRG — the nonprofit parent organization, a 501(c)(3) public benefit organization.
• Let's Encrypt — a project operated by ISRG, acting as a Certificate Authority issuing free TLS certificates.
• Two sibling projects — also operated by ISRG, alongside Let's Encrypt.

What ISRG operates besides Let's Encrypt

The homepage states directly that "Let's Encrypt has two sibling projects" and that "Let's Encrypt and these two projects are operated by Internet Security Research Group (ISRG)." The page groups this under a section titled "More ways we're improving security and privacy," which is the framing ISRG uses for its wider portfolio: the goal is not only certificate issuance but security and privacy improvements more generally.

The source material confirms the existence and ownership of these two sibling projects but does not name them on the homepage. If you need the specific project names and what each one does, the annual report and the linked project pages are the places to look rather than the homepage summary.

How to follow ISRG's work

The 2025 Annual Report is presented as the main overview: "Our 2025 Annual Report highlights the progress we've made toward a better Internet." That is the most direct route to understanding what ISRG has been doing across Let's Encrypt and its sibling projects.

Other entry points on the site:

The blog is worth noting because it covers work beyond routine certificate issuance. Recent posts shown on the homepage include an engineering write-up on building a data warehouse with ClickHouse, a post on preparing certificates for a post-quantum future through an approach called Merkle Tree Certificates, and a historical piece about ISRG Root X1. Together they show the range of what ISRG treats as part of its security and privacy mission.

Funding and why the nonprofit status is relevant

The homepage ties ISRG's work to donations and sponsorship: "Your donation helps keep Let's Encrypt free and accessible to millions of websites around the world," and companies "who rely on or value our work to encrypt the Web can financially support Let's Encrypt." The section is headed "Global impact made possible by generosity."

That is the practical link between the two questions. Let's Encrypt is free to use because ISRG is a nonprofit funded by donations and sponsors, not because certificates are a loss-leader for a paid product. If you want to know who runs Let's Encrypt, the answer is ISRG; if you want to know what else that organization does, the answer is two sibling projects plus ongoing security and privacy work, documented in the annual report.

ACME clients are software tools that talk to Let's Encrypt on your behalf to request, install, and renew TLS certificates automatically. Let's Encrypt recommends them because its certificates are designed to be short-lived and renewed often, and doing that by hand does not scale. If you run one website and want HTTPS with minimal ongoing effort, an ACME client is the intended way to get there. If you need a certificate for a system that cannot run automation, an ACME client may not fit, and you would need a different approach.

What "ACME" means here

ACME stands for Automatic Certificate Management Environment. It is the protocol Let's Encrypt uses to verify that you control a domain and then issue a certificate for it.

The important part is the word automatic. Let's Encrypt describes itself as a Certificate Authority that provides free TLS certificates to make it easy for websites to enable HTTPS. Its own getting-started guidance states that to get a certificate for your domain, you have to demonstrate control over that domain. An ACME client handles that demonstration and the follow-up steps for you.

What an ACME client actually does

An ACME client is the piece of software that:

• Generates a key pair and a certificate signing request for your domain.
• Proves domain control to Let's Encrypt (for example, by serving a challenge file or a DNS record).
• Downloads the issued certificate.
• Installs it where your web server or service expects it.
• Renews it before it expires, repeating the cycle.

Let's Encrypt's site points visitors to a list of recommended ACME clients and describes them as the way to "automatically manage your certificates." That is the core value: you configure it once, and certificate issuance and renewal become background work rather than a recurring manual task.

Why Let's Encrypt recommends clients instead of manual issuance

Let's Encrypt's certificates are meant to be replaced frequently. Manual renewal is where most outages happen: someone forgets, a certificate lapses, and the site starts showing security warnings. Automation removes that failure mode.

The recommendation also reflects how the service is built. Let's Encrypt is a project of the nonprofit Internet Security Research Group (ISRG), and its stated goal is encryption for everybody, at a scale of more than 700 million websites. That scale only works if issuance is automated, which is why the client ecosystem exists and why the site routes users toward it.

How to choose and get started

Let's Encrypt does not push a single client. It offers a recommended list so you can match the tool to your environment.

1. Identify where your certificate needs to live. A typical web server, a container, a load balancer, or a service that terminates TLS.
2. Browse the recommended ACME clients on Let's Encrypt's site and pick one that supports your platform and your preferred level of control.
3. Read the documentation to understand the issuance process and best practices before you configure anything.
4. Run the client against your domain and confirm the certificate is issued and installed.
5. Verify renewal works rather than assuming it does. A test renewal is the difference between "set up" and "actually set up."

If you get stuck, Let's Encrypt maintains a community forum for technical assistance and knowledge sharing with experts, volunteers, and ISRG staff.

Where an ACME client is not the right fit

Automation assumes the client can run somewhere with access to your domain and your server configuration. If your certificate has to be installed on a device or platform that cannot run a client or accept automated updates, the standard ACME workflow may not apply directly. In that case, check the documentation and the client list for your specific environment before committing to an approach.

The short version

ACME clients exist because Let's Encrypt's model depends on frequent, automated certificate management. Let's Encrypt recommends them, publishes a list to choose from, and provides documentation and a community forum for the rest. Start with the client list, read the documentation, and confirm that renewal actually runs.

Let's Encrypt is a free, automated, and open Certificate Authority (CA) that issues TLS certificates so websites can enable HTTPS encryption. It is operated by the Internet Security Research Group (ISRG), a nonprofit organization, and according to its website it provides free TLS certificates to more than 700 million websites. If you own or manage a domain and want HTTPS without paying for certificates or configuring them by hand, Let's Encrypt is built for that use case.

What Let's Encrypt actually provides

A TLS certificate is what lets a browser establish an encrypted connection to your site and verify that it is talking to the domain it claims to be. Let's Encrypt issues those certificates at no cost and designs the process to be automated rather than manual.

The three words in its own description matter:

• Free — no payment is required to obtain a certificate.
• Automated — issuance and renewal are meant to run through software (ACME clients), not by hand.
• Open — the CA and its processes are open, and it is run by a nonprofit rather than a commercial vendor.

Who runs it

Let's Encrypt is a project of the Internet Security Research Group (ISRG), described on the site as a 501(c)(3) public benefit organization focused on making the Internet more secure and private. Funding comes from donations and corporate sponsorship, which is how the certificates stay free.

ISRG also operates two sibling projects alongside Let's Encrypt, all under the same nonprofit umbrella.

How you get a certificate

The key requirement is stated plainly on the site: to get a certificate for your website's domain, you have to demonstrate control over that domain. That domain-validation step is what prevents someone from obtaining a certificate for a domain they don't own.

The practical path looks like this:

1. Choose an ACME client. Let's Encrypt maintains a list of recommended ACME clients that automatically manage your certificates. The client is the software that talks to Let's Encrypt on your behalf.
2. Prove control of your domain. The client handles the challenge that demonstrates you control the domain.
3. Receive and install the certificate. The client obtains the certificate and configures it for your server.
4. Renew automatically. Because certificates expire, the client is designed to renew them without manual intervention — this is the main reason automation matters.

If you'd rather understand the process before running it, Let's Encrypt publishes documentation covering its certificate issuance process and best practices.

When Let's Encrypt is the right fit

Where to go next

• Getting started: the site's "Get Started" path walks through securing a site with a free certificate.
• Documentation: read up on the issuance process and best practices before deploying.
• ACME clients: browse the recommended clients to pick one that matches your server setup.
• Community forum: ask questions and share knowledge with other users and ISRG staff.

The short version: if you control a domain and can automate certificate management, Let's Encrypt gives you free TLS certificates through a nonprofit CA — and its scale (700M+ websites) reflects how widely that model has been adopted.

Yes. Let's Encrypt issues TLS certificates at no cost, and the site describes itself as "a nonprofit providing free TLS certificates to more than 700M websites." There is no paid tier described on the page, and no pricing, checkout, or payment flow appears in the site content. The free certificates are funded by donations and corporate sponsorship rather than by charging the people who use them.

What "free" actually covers

The certificate itself costs nothing. According to the site, Let's Encrypt is a Certificate Authority that provides free TLS certificates so websites can enable HTTPS encryption. It is a project of the nonprofit Internet Security Research Group (ISRG).

Two practical conditions come with that:

• You must prove control of the domain. The site states plainly: "In order to get a certificate for your website's domain, you have to demonstrate control over the domain." This is a technical requirement of the issuance process, not a fee.
• You need an ACME client to automate issuance and renewal. Let's Encrypt points users to a list of recommended ACME clients for automatically managing certificates.

So the cost is zero, but the work of setup and renewal is yours (or your client's) to automate.

Why it can stay free

The model is donation- and sponsor-funded, not ad- or fee-funded. The page's "Global impact made possible by generosity" section asks visitors to donate, saying contributions "help keep Let's Encrypt free and accessible to millions of websites around the world." A separate sponsorship path exists for companies that "rely on or value our work to encrypt the Web."

This matters if your real question is durability: the free service is tied to continued giving, and the site treats individual donations and company sponsorship as the mechanism that sustains it.

What the page does not say

Be careful not to read more into "free" than the source supports:

• No rate limits, certificate lifetimes, or per-domain quotas are stated on this page.
• No paid plans, premium support, or upsells are mentioned.
• No account, login, or payment requirement is described for obtaining a certificate.

If you need those specifics, they belong to the documentation and ACME client pages rather than the homepage.

If you want to use it

1. Confirm you can demonstrate control over the domain you want a certificate for.
2. Pick a recommended ACME client from the site's list to handle issuance and renewal automatically.
3. Read the documentation for the issuance process and best practices.
4. If you get stuck, the Let's Encrypt community forum is offered for technical assistance from experts, volunteers, and ISRG staff.

If you want to support it

• Individuals: use the Donate option; the site frames every contribution, large or small, as making a difference.
• Companies: explore the sponsorship program, which the site presents as the route for organizations that depend on or value encrypted web traffic.

Either way, the certificates you or others obtain remain free — the giving is what keeps that true.

To get a Let's Encrypt certificate for your website, you need to (1) demonstrate control over your domain, (2) use an ACME client to request and install the certificate, and (3) keep it renewing automatically. Let's Encrypt is a nonprofit certificate authority that issues free TLS certificates, so the main cost is setup effort rather than money. The steps below follow the path Let's Encrypt itself recommends: prove domain control, pick a recommended ACME client, follow the documentation, and use the community forum if you get stuck.

What Let's Encrypt actually provides

Let's Encrypt is a Certificate Authority (CA) operated by the Internet Security Research Group (ISRG), a 501(c)(3) public benefit organization. It issues TLS certificates that let a website serve HTTPS, and it describes itself as providing free TLS certificates to more than 700 million websites.

Two things follow from that:

• The certificate itself is issued at no charge, and the project is funded by donations and corporate sponsorship.
• Issuance is built around automation. You are not meant to file a manual request and wait; you are meant to run a client that handles requesting, installing, and renewing.

Step 1: Confirm you can prove control of the domain

Before any certificate is issued, you must demonstrate control over your website's domain. This is a hard requirement, not a formality — it is what stops someone else from getting a certificate for your name.

In practice this means you need one of:

• The ability to place a file at a specific path on the web server for that domain, or
• The ability to add a DNS record for that domain, or
• Control of the server that answers on the domain's address.

If you rent a site from a host and cannot touch DNS or the web root, check whether the host offers a built-in Let's Encrypt option before continuing — many do, and that path skips the manual work entirely.

Step 2: Choose a recommended ACME client

ACME is the protocol Let's Encrypt uses for automated issuance. You interact with it through a client, and Let's Encrypt publishes a list of recommended clients rather than a single mandatory tool.

Browse the official ACME client list and pick one that matches your server and your comfort level. The client is what turns "I want a certificate" into an automated, repeatable process.

Step 3: Follow the documentation for issuance and renewal

Let's Encrypt's documentation covers the issuance process and best practices. Read it before you run anything in production, because the details that matter most are the ones that are easy to get wrong:

• Renewal timing. Certificates are short-lived by design, so renewal must be automatic. A certificate that expires because renewal was manual is the most common way a working HTTPS setup breaks.
• Rate limits. Issuance is rate-limited. Testing against the staging environment first avoids burning your production quota on failed attempts.
• Where the certificate lives. Know which files your client writes and which config lines point at them, so you can verify the result rather than assume it.

Step 4: Verify it worked

After the client runs, check the actual result rather than trusting the success message:

1. Load your site over https:// and confirm it loads without a certificate warning.
2. Inspect the certificate in your browser and confirm the domain name matches and the issuer is Let's Encrypt.
3. Confirm the renewal mechanism is scheduled (a timer, cron job, or the client's own daemon) and that it will run without you.

If step 3 is missing, you have a certificate that works today and fails later.

When something goes wrong

Let's Encrypt runs a community forum for technical assistance and knowledge sharing, staffed by experts, volunteers, and ISRG staff. It is the right place for validation failures, client configuration problems, and questions about whether a specific setup is supported. Search first — validation errors tend to be common and already answered.

A realistic expectation of effort

The first certificate is the slow part: proving domain control and getting one client configured correctly. After that, the same client renews indefinitely without intervention, which is the entire point of the design. If your host already integrates Let's Encrypt, you may be able to skip straight to enabling HTTPS in the control panel and never touch an ACME client directly.