fshy / Domains and DNS

Let's Encrypt

letsencrypt.org · Domains and DNS · 1 record · JSON

Let's Encrypt Domains and DNS

★ qualifiesanonymousno cardMrequest-rate

letsencrypt.org/docs/rate-limits/ · certificate authority · domains-dns/lets-encrypt · JSON · compare

Free tier	free 90-day certificates including wildcards over DNS-01, with automated issuance and renewal unit unlimited; metered on request-count
Price	none stated
Per-object cap	no certificate size cap; the binding limits are rate limits and not object caps
Retention	a certificate is valid 90 days and must be renewed; ARI lets a client renew early (90 days)
Egress	no charge
Identity	anonymous no account is required to obtain a certificate; an ACME account key is generated locally and is not a registration
Limits	request-rate 50 certificates per registered domain per 7 days, global across all accounts, refilling at 1 per 202 minutes source request-rate 5 certificates per exact set of identifiers per 7 days source request-rate 300 new orders per account per 3 hours source request-rate 10 new accounts per IP per 3 hours source request-rate 5 failed authorizations per identifier per account per hour; 1,152 consecutive failures then the identifier pauses source retention-clamped a certificate is valid 90 days; renewal is the client's job and there is no automatic extension source
Binding	request-rate
Interface	rest the ACME v2 protocol at acme-v02.api.letsencrypt.org, with a staging endpoint for testing
Tooling	certbot, acme.sh, lego, Caddy, Traefik, any ACME client
Composes with	free TLS on any name you control, including a wildcard, which is what makes the free-DNS plus free-tunnel chain terminate in a valid certificate
Reliability	no reliability event recorded
Notes	The per-registered-domain limit is the one that binds a multi-tenant scheme: 50 certificates a week for every name under one registered domain, whoever requests them. The exact-identifier limit is the one that binds a retry loop, and 5 an hour is reachable in a bad afternoon.
Evidence rung	measured the production and staging directories were fetched today and answered 200 with the profile list; the rate limits are a first-party page. The 90-day validity is on the FAQ page, not on the rate-limits page it was attributed to.
Checked	2026-10-23 (live); stale on 2027-01-21
Parsed numbers	`$.limits[0].value` limit:request-rate 202.0 minutes `$.limits[2].value` limit:request-rate 3.0 hours `$.limits[3].value` limit:request-rate 3.0 hours

Evidence (4)

date	source	what it proved
2026-10-22	probe:https://acme-v02.api.letsencrypt.org/directory	200, 961 bytes, sha256 ee1bfe324dcd5aff6e67ba25ea98397494d5b6ebf6c7f16e98348254636190e0, listing keyChange, the classic, shortlived and tlsserver profiles, and the current subscriber agreement URL
2026-10-22	probe:https://acme-staging-v02.api.letsencrypt.org/directory	200, 1,035 bytes; the staging endpoint is live, so an issuance test costs nothing against the production limits
2026-10-22	letsencrypt.org/docs/rate-limits/	50 certificates per registered domain per 7 days; 5 per exact set of identifiers per 7 days; 300 new orders per account per 3 hours; 10 accounts per IP per 3 hours; 5 failed authorizations per identifier per hour; 1,152 consecutive failures; ARI renewals are exempt from the order and per-domain limits
2026-10-22	letsencrypt.org/docs/faq/	'Our default certificates are valid for 90 days'; the same FAQ points at the published rationale

Unknown or withheld values (1)

$.reliability_note none-observed

Built from commit 872967ae41, data as of 2026-10-27. Every value links to its source; freshness badges are computed in your browser. How to read this.