Let's Encrypt is a nonprofit certificate authority, launched in 2015 by the Internet Security Research Group (ISRG), that issues free, automated, domain-validated certificates. It's now one of the most widely used CAs in the world, largely because it removed both barriers that previously kept HTTPS out of reach for smaller sites: cost, and manual renewal effort.
How issuance actually works
Let's Encrypt issues certificates through the ACME protocol. A client on your server (commonly Certbot, or built into hosting control panels) proves domain control automatically — usually by placing a specific file at a known URL, or adding a DNS record — and Let's Encrypt's servers verify it before issuing the certificate, all without a human on either end.
The 90-day validity window
Let's Encrypt deliberately issues short-lived, 90-day certificates rather than the longer windows some paid CAs offer. This isn't a limitation to work around — it's designed to force automated renewal, which is both more reliable long-term than a manual yearly task and limits the exposure window if a certificate or key is ever compromised.
How ACME validation actually proves you control a domain
An ACME client on your server responds to a specific, CA-issued challenge, either serving a particular file at a known URL, or adding a DNS TXT record with a specific value, that only someone with genuine control over the domain or server could satisfy — Let's Encrypt's servers verify this automatically before issuing, with no human review needed.
Why the nonprofit structure specifically mattered for adoption
Being backed by a nonprofit with major industry sponsorship, rather than a single commercial vendor, gave Let's Encrypt the institutional credibility and financial sustainability needed to operate at massive scale for free — a combination smaller, earlier free CA efforts hadn't achieved, which is part of why Let's Encrypt succeeded where those predecessors saw more limited adoption.
How Let's Encrypt's issuance volume compares to the rest of the industry
Within a few years of its 2016 public launch, Let's Encrypt became one of the highest-volume certificate authorities in the world by number of certificates issued, reflecting how completely free, automated issuance reshaped what most of the web's smaller and mid-sized sites actually use for HTTPS.
How Let's Encrypt is actually funded as a nonprofit
Let's Encrypt operates under the Internet Security Research Group, funded through a combination of corporate sponsorships from major technology companies and individual donations, rather than charging for the certificates themselves — this sponsorship model is what makes free, high-volume issuance financially sustainable at internet scale.
What the ISRG does beyond just running Let's Encrypt itself
The Internet Security Research Group's broader mission includes funding and supporting other internet security research and infrastructure projects beyond Let's Encrypt specifically, reflecting a wider organizational goal of improving internet security accessibility rather than being narrowly focused on certificate issuance alone.
Its broader significance beyond just being one certificate authority among many
Let's Encrypt is best understood not just as a CA, but as the specific catalyst that made automated, free HTTPS the industry default — an achievement with an impact on the overall web's security posture that's arguably larger than any single named vulnerability discussed elsewhere on this site.
What Let's Encrypt's transparency reports reveal about its own operational scale
Let's Encrypt publishes its own operational statistics and transparency reports, offering genuine public insight into issuance volume and infrastructure scale — a level of operational transparency that's itself somewhat unusual within the broader certificate authority industry.
A closing thought
A quick closing thought: it's genuinely rare for a single nonprofit initiative to reshape an entire industry's default behavior as thoroughly as Let's Encrypt reshaped how the web approaches HTTPS.