Let’s Encrypt and HTTPS

In 2015, getting an HTTPS certificate for a small site was still often hard or expensive. That year Let’s Encrypt opened a public beta to issue free, automated certificates. A decade later, encrypting a web connection is no longer the exception. A large share of sites now run on certificates that are issued and renewed automatically, and Let’s Encrypt is one of the main issuers.

This page is the history and the practical meaning of that change, not an advertisement for one issuer. For someone opening a page, a lock next to the address should now be normal, and its absence should raise a question. For someone who runs a site, HTTPS is the expected default and renewal should not be left to memory. Do not confuse web encryption with end-to-end messaging; that separate layer is explained in does encryption still help.

What the lock next to the address tells a reader

The lock only says the connection to the domain you see in the address bar is encrypted, and that it cannot easily be read or changed in the middle. It does not say who owns the site, whether the content is honest, or that the page is not phishing. A deceptive site can have a valid certificate too.

1. Before you type a password or a card number, read the domain name itself letter by letter. One character out of place is enough to put you on another domain that also has a lock.
2. If the browser shows a certificate warning — expired, a name mismatch, or an unknown issuer — do not bypass it unless you have a clear technical reason you yourself understand.
3. In most browsers you can tap the lock to see whether the connection is reported as secure. That check is not a substitute for reading the domain.
4. A page that still loads part of itself over HTTP may show a mixed-content warning. Do not ignore that warning if you are about to enter data.

Browsing habits, extensions and the official browser path are in the guide to safer web browsing. HTTPS alone does not lift a network filter; that topic is separate in how internet access is restricted.

What Let’s Encrypt changed

Let’s Encrypt’s model was to automate issuance with the ACME protocol so a site operator would not have to replace a file by hand every time. The certificate is free and does not display an organization’s identity the way some commercial certificates do; for most sites, encrypting the connection is what matters.

As of November 2026 a default Let’s Encrypt certificate is usually valid for about ninety days. The issuer has said that from 10 February 2027 the default lifetime becomes sixty-four days, and later it becomes shorter still. The practical meaning is that manual renewal is no longer a stable method, and an old fixed calendar may not match the new lifetime.

1. If you run a site, see whether your host renews Let’s Encrypt or another issuer automatically.
2. Check the expiry date in the host panel or by looking at the certificate in a browser, not from memory.
3. Ask the ACME client to pay attention to the issuer’s renewal information (such as ACME Renewal Info), rather than only renewing every sixty days on a fixed calendar.

If you run a site

Visitors now expect the address to open with HTTPS and the browser not to warn that a certificate has expired. Get the certificate through your host’s official path or from Let’s Encrypt’s own documentation at letsencrypt.org, not from an unknown file someone sent in a group.

1. Turn on the host panel’s official SSL or Let’s Encrypt option if the host supports it. Many hosts handle renewal themselves.
2. If you install a client yourself, get Certbot and similar tools from their official site or from your distribution’s official package.
3. After issuance, run a test renewal or a dry run according to that client’s documentation, so you do not find out only on expiry day when the site is down.
4. Allow for a changed address, a new subdomain or a new server; an old certificate is not enough for a new name, and those names must appear on the certificate.
5. Finish the move to HTTPS: put internal links on HTTPS and send HTTP requests correctly to the encrypted version so a visitor does not stay on the open copy.
6. Do not ignore a browser warning about an expired certificate. Visitors see the same warning, and many of them — rightly — close the page.

Know that certificate transparency exists

Certificate Transparency logs make the issuance of a certificate for a domain visible. If you run an important domain, it is worth knowing that this record exists and that unexpected issuance can be seen.

1. If you see a new certificate for your domain that you did not request, take it seriously: check the configuration and, if needed, follow up with the host or the issuer’s official process.
2. Transparency alone does not stop phishing on a look-alike domain. The visitor still has to read the name.

Do not mix HTTPS with other layers

A web lock means the path to that domain is encrypted. After the request arrives, the site operator can usually see the content. Webmail with a lock is still readable to the provider unless you add another layer such as OpenPGP; account hardening is in the guide to safer email accounts.

1. Fill in a sign-in form only on the main domain you already know.
2. If a page has no certificate and asks for a password, treat that as a warning sign.
3. Do not confuse a VPN or Tor with HTTPS. They answer other questions: the network path or separation. A site lock does not replace them, and they do not replace a site lock.

What to do if the browser warns

A certificate warning does not always mean “an attacker on the Wi-Fi.” Sometimes the device clock is wrong, sometimes the site’s certificate has really expired, and sometimes the name on the certificate does not match the address you typed. In every case, bypassing the warning in order to type a password is dangerous.

1. First check the device’s date and time. A clock that is far ahead or behind can make a valid certificate look expired.
2. Read the address again and, if needed, open it from a source you already know, not from a link in a message.
3. If the site is yours, go to the host panel and check expiry and the names on the certificate; fix renewal there rather than telling visitors to ignore the warning.
4. If the site belongs to someone else and the warning continues, do not do sensitive work there at that moment.

Which names must be on the certificate

A certificate only works for the names that appear on it. The apex domain, a www prefix and separate subdomains will show a warning if they are missing, even if it “looks like the same site.”

1. Write down the names people actually type in a browser and include those names when the certificate is issued.
2. A certificate issued for one name does not cover a new subdomain you create later, unless you issue a certificate with that new name or you knowingly use an allowed wildcard.
3. Do not treat a move from one host to another as finished without issuing a fresh certificate; copying an old file may not match the new name or key.

What Let’s Encrypt does not do for you

Automated issuance does not clean a site of malware, deceptive content or a break-in to the admin account. Let’s Encrypt usually does not display a legal organization identity the way some certificates that show a company name do. For most readers the lock on the connection is what matters, not a company logo in the address bar that common browsers no longer show.

1. Lock the site’s admin panel with a unique password and, if the host offers it, two-factor authentication. A valid certificate does not protect an open panel.
2. Keep the site’s software updated. HTTPS encrypts the connection; it does not close a vulnerability in an old plugin.
3. If you only have a personal blog, follow the host’s official path and do not take on a complex server setup unless you can maintain it.

On an organizational device the lock may mean something else

On some workplace or school networks the device is configured so a middlebox opens HTTPS traffic and encrypts it again. On that device you still see a lock, but an observer on the same network may see the content. That is different from café Wi-Fi that does not have the site’s certificate.

1. If the device belongs to an organization, do not assume the lock means nobody on the path can see the content.
2. Do not do highly sensitive personal work on a device whose security policy you do not know.
3. If you are only on public Wi-Fi and a certificate warning appears, treat that warning as a real danger, not an ordinary bump that can be brushed aside very easily.

Common mistakes

• Assuming the lock means the site’s owner is verified and the content is safe.
• Bypassing a certificate warning because “it worked yesterday.”
• Renewing by hand every few months for a site that should now renew automatically.
• Getting an ACME client from an unknown link.
• Turning on a certificate for the main domain and leaving the HTTP copy or forgotten subdomains as they are.
• Treating HTTPS as the same thing as end-to-end messaging or as anonymity.

What to do today

1. If you run a site, check that its certificate renews automatically and look at the expiry date. If the documentation has a test renewal, run it once.
2. If you are only a reader, respect the browser’s certificate warning and read the domain before you sign in.
3. Do not confuse web encryption with end-to-end messaging; they are separate layers.
4. If you run an important domain, learn what certificate transparency is so unexpected issuance is not a surprise.