What it is
Let's Encrypt is a free, automated certificate authority run by the nonprofit Internet Security Research Group. It issues domain-validated TLS certificates so any website can serve HTTPS without paying for a certificate or filling in forms. Its arrival removed cost and paperwork as reasons to leave a site on plain HTTP, and it is trusted by all major browsers.
Certificates are requested and renewed through the ACME protocol, usually by a client such as Certbot running on the server. Because they are short-lived and renew automatically, there is no yearly purchase or reminder to forget. Let's Encrypt has become one of the largest certificate authorities on the web by number of certificates issued.
How I use it
- TLS for every host on the stucco company's server, alongside Apache security headers.
- TLS on Lend Pilot's nginx origin, behind CloudFront.
- Issued and renewed with Certbot from the command line.
- Paired with CAA records in DNS, which limit which authorities may issue certificates for a domain.
Let's Encrypt is the right tool for TLS on servers I run directly, where nothing else manages the certificate. I use it because renewal is automatic, so a certificate never expires because someone forgot a date. Where CloudFront is in front, AWS Certificate Manager handles the edge.
Questions
Do free certificates give the same encryption?
Yes. A Let's Encrypt certificate provides the same TLS encryption as a paid domain-validated certificate. What it does not include is organization validation or a warranty.
Let's Encrypt or AWS Certificate Manager?
Both, in different places. ACM covers domains served through CloudFront, and Let's Encrypt covers origin servers I run directly.