How it works: an SSL certificate in three steps
In short
You enter your domain and prove it is yours (with a file on your server or a DNS record), and your browser creates the key and gets the certificate from Let's Encrypt. You get files to upload in your hosting control panel. After about two months we remind you to renew.
1. Enter your domain
Type the names the certificate should work for, separated by commas, for example example.com, www.example.com. One certificate can cover up to 10 names. A certificate for all subdomains is *.example.com; it requires verification with a DNS record.
You also choose the key type. ECDSA P-256 is smaller and faster; RSA 2048 is accepted by practically every panel, including those that do not support ECDSA (e.g. OVHcloud hosting and QNAP NAS). If you save your hosting provider in your account, the generator picks the right type for you.
2. Prove that the domain is yours
Let's Encrypt issues a certificate only to whoever controls the domain. The generator shows exactly what to do, with a “Copy” button next to each value. You can choose between two methods:
Let's Encrypt opens the address:
http://yourcompany.com/.well-known/acme-challenge/file-name
- the site must work over http, on port 80
- you upload one small file, e.g. via FTP or a file manager
- does not work for wildcard certificates
Let's Encrypt asks the domain's DNS servers for the record:
_acme-challenge.yourcompany.com TXT value
- you add the record in the panel where the domain is managed
- always works, even when there is no website yet
- required for *.yourcompany.com
If you are not sure which one to choose: if your website is already live and you can upload a file to it, choose the file. If your site runs on an application that intercepts every address, or you need a wildcard certificate, choose the DNS record.
3. Private key and certificate
Once the domain is verified, your browser creates the private key and the certificate request (CSR). Only the request, which contains the domain names and the public key, is sent to Let's Encrypt. The certificate is ready within a few seconds. The private key never leaves your browser; details on the Security page.
The files you get
| File | What it contains | When to use it |
|---|---|---|
privkey.pem | the private key | always; only in your hosting control panel or on your own server |
fullchain.pem | the certificate with the intermediate certificates | in most panels and on nginx and Apache servers |
cert.pem | just the certificate for your domain | when the panel has a separate field for the chain |
chain.pem | just the intermediate certificates | for the “CA”, “chain” or “intermediate certificate” field |
Installing it on your hosting
You upload the files where your website runs: in your hosting control panel, on a server or on a NAS. We have prepared step-by-step guides with the names of the fields in each panel and which file to paste where:
OVHcloudHostingerPleskcPanelDirectAdminOwn server (nginx or Apache)Proxmox VESynology NASQNAP NASTrueNASUnraidOpenMediaVault NASOther hosting
Test mode
Test mode runs the whole process on the Let's Encrypt test environment. A test certificate is not trusted by browsers, but it lets you check that the file or DNS record is correct without using up the production limits. Once everything works, repeat the process in production mode.
Production mode works for names that passed test mode in the last 30 days or already have a production certificate in your account. Failed production attempts count against the Let's Encrypt limits, while test attempts cost almost nothing, so it is better to catch mistakes in a test. When you renew, you do not need to repeat the test.
We remember your Let's Encrypt account key in this browser, so later attempts do not create new accounts. This matters because Let's Encrypt allows at most 10 accounts per 3 hours from one IP address.
Renewal
A Let's Encrypt certificate is currently valid for 90 days. Renewing means repeating the three steps and uploading the new files to the same place. The new certificate also has a new private key, because we do not keep the previous one.
When you save a production certificate in your account, we send a reminder after two thirds of its validity (for 90 days that is around day 60) and a second one a week before it expires. Let's Encrypt has announced that validity will be shortened to 64 days from February 10, 2027 and to 45 days from February 16, 2028; the reminders adjust automatically, because we calculate them from the dates in the certificate.