Quick answer: Let’s Encrypt is a free, automated certificate authority that issues domain validated SSL certificates trusted by the major browsers. It entered public beta on 3 December 2015, so anyone can now get a certificate at no cost. Certificates last 90 days and are meant to be renewed automatically. For most business websites that need HTTPS for logins, contact forms or a small shop, it does the job. Sites that need an organisation name in the certificate, an extended validation green bar, or a wildcard certificate still need a paid option.
For years, the cost and hassle of SSL certificates were a common reason small businesses stayed on plain HTTP. Let’s Encrypt removes the cost entirely and aims to remove most of the hassle. Here is what that means for your website.
What Let’s Encrypt is
Let’s Encrypt is run by the Internet Security Research Group, a non profit, with backing from organisations including Mozilla, the Electronic Frontier Foundation, Akamai and Cisco. Its goal is to make encrypted connections the default across the web.
It differs from traditional certificate authorities in three ways:
- It is free. There is no charge for certificates.
- It is automated. Software on your server requests, installs and renews certificates using a protocol called ACME, with no forms or emails.
- It is open. The software and protocol are published openly.
Its certificates are cross signed by IdenTrust, which is why mainstream browsers already trust them.
Why HTTPS matters for a business site
- Security. HTTPS encrypts data between the visitor’s browser and your server, protecting passwords, form entries and payment details.
- Trust. Browsers show a padlock in the address bar, and visitors increasingly look for it before entering details.
- Search. Google confirmed in August 2014 that HTTPS is a ranking signal. It is a light one, but it counts.
- Speed. Browsers only support the newer HTTP/2 protocol over HTTPS, and HTTP/2 can make pages load faster.
- Referral data. When visitors move from an HTTPS site to an HTTP one, the referrer is usually dropped. Being on HTTPS keeps more of your referral data intact.
If you have a WordPress login or a contact form, HTTPS is worth doing now. It is also part of any sensible WordPress security checklist.
Let’s Encrypt vs paid certificates
Domain validation only
Let’s Encrypt issues domain validated (DV) certificates. They prove you control the domain, but not who you are. The browser shows a padlock and “https”, which is all most visitors notice.
Paid certificate authorities also sell:
- Organisation validated (OV) certificates, which include your company name in the certificate details.
- Extended validation (EV) certificates, which show your company name in green in the address bar in most browsers. Banks and large ecommerce sites often use these.
If you want that green bar, Let’s Encrypt is not the answer.
90 day lifetime
Let’s Encrypt certificates last 90 days, compared with one to three years for most paid certificates. This is deliberate. Short lifetimes limit damage if a key is stolen and push everyone towards automatic renewal. If your renewal is automated, the short lifetime does not matter. If it is not, it means a manual job every couple of months, which is easy to forget.
No wildcard certificates
Let’s Encrypt does not issue wildcard certificates such as *.example.com. You can include several names in one certificate, for example example.com, www.example.com and shop.example.com, but each must be listed.
Rate limits
During the beta there are limits on how many certificates can be issued per domain per week. This rarely affects a normal business site, but it can matter if you run many sub domains.
Support and warranty
Paid certificates often come with customer support and a warranty. Let’s Encrypt relies on community forums and documentation. For many small sites, your host’s support covers what you need.
How to get a Let’s Encrypt certificate
Option 1: Through your host
The easiest route. Some hosting companies have started building Let’s Encrypt into their control panels, so you can switch it on with a click and renewal happens in the background. Others have said they plan to. Ask your host before doing anything yourself. If they only offer paid certificates and refuse to support free ones, that tells you something about the host.
Option 2: On your own server
If you manage your own VPS or dedicated server, you can use the official Let’s Encrypt client:
- Install the client on the server. It is available from the Let’s Encrypt site and through GitHub.
- Run it for your domain. On Apache, it can request the certificate and update your configuration automatically. On Nginx, you will usually request the certificate and then edit the configuration yourself.
- Set up automatic renewal, for example with a cron job that runs the renewal command regularly.
- Test that renewal works before the first certificate is close to expiring.
Other ACME clients exist for different setups, including lightweight scripts for servers where you prefer not to run the official client.
Option 3: Through a CDN
Services such as CloudFlare offer free SSL between visitors and their network, even without a certificate on your server. That helps, but for full protection you still want a certificate on your own server too, and Let’s Encrypt is an easy way to get one.
Moving your site to HTTPS
Getting the certificate is only the first step. To switch the whole site:
- Install the certificate and check that https:// loads correctly.
- Update internal links, images, scripts and stylesheets to use HTTPS, to avoid mixed content warnings.
- On WordPress, update the site address and WordPress address in Settings, General, then run a search and replace on the database for old URLs.
- Add 301 redirects from every HTTP URL to its HTTPS version.
- Add the HTTPS version of the site to Search Console and submit an updated sitemap.
- Update your Google Analytics property and view settings to use https, and update links on social profiles and directories.
- Once everything is stable, consider adding HTTP Strict Transport Security (HSTS).
Our guide to HTTPS migration and SEO covers this process in more detail, including how to protect rankings during the move.
Is it ready for business use?
It carries a beta label, but the certificates are real, trusted and already in use on a large number of sites. The main practical risks are renewal failing quietly and some very old devices or software not accepting the certificates. For a typical business brochure site, a blog or a small shop, those risks are small and easy to manage with monitoring.
Consider a paid certificate if:
- You want your company name shown in the browser bar (EV).
- You need a wildcard certificate.
- Your host does not support Let’s Encrypt and you cannot automate renewal.
- You must support a specific list of very old devices.
FAQ
Is a free certificate less secure than a paid one?
No. The encryption is the same strength. The difference is in validation, lifetime and support, not in how well your data is protected.
Will Let’s Encrypt work with WordPress?
Yes. The certificate is installed on the server, so it works with WordPress and any other CMS. After installing it, update your site URLs and add redirects.
What happens if renewal fails?
The certificate expires and visitors see a security warning. Set up monitoring or calendar reminders until you are confident automatic renewal works.
Does it work for ecommerce?
For most small shops, yes. Payment pages hosted by providers such as PayPal or Stripe have their own certificates anyway. Large stores may prefer EV for the visible company name.
Need help moving to HTTPS?
We set up certificates, handle the migration and check nothing breaks along the way, so your site is safer without losing traffic. See how we help sites turn visitors into customers safely.
