---
title: Let’s Encrypt
description: A free certificate authority that issues trusted SSL/TLS certificates for HTTPS, often with auto-renew on hosting panels.
canonical: https://penasihathosting.com/en/hosting-wiki/lets-encrypt
type: wiki
locale: en
updated: 2026-07-15
author: Willya Randika
---

# Let’s Encrypt

## Overview

- **Summary:** A free certificate authority that issues trusted SSL/TLS certificates for HTTPS, often with auto-renew on hosting panels.
- **Author:** Willya Randika ([profile](/penulis/willya-randika))

## Article

**Let’s Encrypt** is a free certificate authority (CA) that issues trusted [SSL/TLS](/en/hosting-wiki/ssl-tls) certificates for HTTPS. On modern shared hosting, install is often one click in [cPanel](/en/hosting-wiki/cpanel) or AutoSSL, with automatic renewal about every 90 days.

Let’s Encrypt made HTTPS normal for small and mid-size sites. Free does not mean “zero configuration” — DNS must be correct, validation ports reachable, and mixed content still needs cleanup.

## A Simple Analogy

If SSL is a digital ID card for a website, Let’s Encrypt is a **free registry office** that issues the card after you prove you control the domain (via a web file challenge or DNS challenge).

## How Validation Works (Short)

1. You request a certificate for specific hostnames  
2. The CA verifies domain control (HTTP-01 or DNS-01)  
3. The certificate is issued and installed on the web server  
4. Auto-renew extends it before expiry  

For many [addon domains](/en/hosting-wiki/addon-domains) and [subdomains](/en/hosting-wiki/subdomain), each hostname usually needs its own cert or a wildcard.

## Let’s Encrypt vs Paid SSL

| | Let’s Encrypt (DV) | Paid OV/EV/Wildcard |
| --- | --- | --- |
| Cost | Free | Paid |
| Validation | Domain only | Can be stricter |
| Lifetime | ~90 days + auto-renew | Often one year |
| Best for | Blogs, SMBs, small SaaS | Compliance / managed wildcards |

## What to Watch For

- Point DNS at the correct server before issuing  
- Enable HTTP → HTTPS redirects after the cert is live  
- Fix mixed content (`http://` assets)  
- Monitor auto-renew; failed renewals become sudden browser warnings  
- Behind [Cloudflare](/en/hosting-wiki/cloudflare), understand Full/Strict so origin still has a valid certificate  

## FAQ

<Accordion>
  <AccordionItem title="Is Let’s Encrypt less safe because it is free?">
    For transport encryption, a Let’s Encrypt DV cert is equivalent to other CAs’ DV certs. Differences show up in organization validation and commercial extras.
  </AccordionItem>
  <AccordionItem title="Does it support wildcards?">
    Yes (`*.example.com`) via DNS-01 validation. Not every shared panel exposes that flow easily.
  </AccordionItem>
  <AccordionItem title="Why does issuance fail?">
    DNS not ready, firewalls blocking challenges, CA rate limits, or the hostname not pointing at this server.
  </AccordionItem>
  <AccordionItem title="When should I buy paid SSL?">
    When you need OV/EV, a specific SLA, or a wildcard workflow that is easier on your plan.
  </AccordionItem>
</Accordion>