spb/tools-spboucher-ai

1{2  "slug": "lets-encrypt",3  "name": "Let's Encrypt",4  "aliases": ["Let’s Encrypt", "ISRG CA"],5  "vendor": { "name": "Internet Security Research Group (ISRG)", "slug": "isrg", "website": "https://www.abetterinternet.org" },6  "homepage_url": "https://letsencrypt.org/",7  "docs_url": "https://letsencrypt.org/docs/",8  "repo_url": "https://github.com/letsencrypt/boulder",9  "privacy_url": "https://letsencrypt.org/privacy/",10  "product_type": "service",11  "product_status": "active",12  "summary": "Nonprofit certificate authority that issues free, automatically renewable TLS certificates through the ACME protocol",13  "description": "Let's Encrypt is a certificate authority operated by the Internet Security Research Group, a nonprofit. It issues domain-validated TLS certificates at no charge and exclusively through automation: a client speaking the ACME protocol proves control of a domain by answering an HTTP, DNS or TLS-ALPN challenge, receives a certificate, and repeats the process before expiry. Certificates are deliberately short-lived so that renewal is scripted rather than remembered, and the CA has been moving toward even shorter lifetimes and additional certificate profiles.\n\nFor most operators Let's Encrypt is invisible: Caddy, Traefik, certbot, acme.sh and the ACME integrations in hosting platforms and tunnel gateways request and renew certificates automatically. Wildcard certificates are available through the DNS challenge, which requires API access to the zone, and the staging environment lets administrators test configurations against generous limits. The issuing software, Boulder, is open source under MPL-2.0, and all issued certificates appear in public Certificate Transparency logs.\n\nIts constraints are part of the design. Only domain validation is offered, so organization-validated or extended-validation certificates must come from a commercial CA. Rate limits apply per registered domain and are documented; hosts must be reachable on the public internet or have DNS API credentials for challenges; and the short validity means a broken renewal job becomes an outage within weeks. Operators of private or internal hostnames generally pair Let's Encrypt with a DNS challenge or use an internal CA.",14  "capabilities": ["Free domain-validated TLS certificates for public hostnames", "ACME protocol with HTTP-01, DNS-01 and TLS-ALPN-01 challenges", "Wildcard certificates via DNS validation", "Staging environment for testing automation", "Certificate Transparency logging of all issuance", "Open-source CA software (Boulder)"],15  "workflows": ["Let a reverse proxy such as Caddy or Traefik obtain and renew certificates automatically", "Use certbot or acme.sh with a web server that lacks built-in ACME", "Issue a wildcard certificate through a DNS provider API", "Validate a new setup against the staging endpoint before production"],16  "advantages": ["No cost and no manual renewal when automation is in place", "Supported by practically every web server, proxy and hosting platform", "Transparent operations with public incident reporting", "Nonprofit governance"],17  "limitations": ["Domain validation only; no OV or EV certificates", "Rate limits per registered domain", "Requires public reachability or DNS API access for challenges", "Short certificate lifetimes make broken automation visible quickly"],18  "prerequisites": ["A public domain name", "An ACME client or a server with built-in ACME support"],19  "audiences": ["Anyone operating a public website or API", "Self-hosters and small infrastructure teams", "Hosting and platform providers"],20  "alternatives": ["cloudflare", "caddy", "godaddy"],21  "comparison_notes": "Cloudflare provides edge certificates automatically when traffic is proxied through its network and also offers origin certificates for the backend hop; Let's Encrypt gives the operator a publicly trusted certificate directly on the origin. Caddy is not a CA but the most common client that uses Let's Encrypt (and ZeroSSL) transparently. Commercial registrars such as GoDaddy sell paid certificates including OV and EV types, which Let's Encrypt does not issue.",22  "categories": [{ "slug": "dns-domains", "primary": true, "label": "Certificate authority" }, { "slug": "reverse-proxies-web-servers" }],23  "tags": ["tls", "certificates", "acme", "nonprofit", "open-source", "security"],24  "use_cases": ["terminate-tls", "host-web-apps"],25  "operating_systems": ["any"],26  "execution_modes": ["cloud"],27  "interfaces": ["api", "cli"],28  "deployment_models": ["saas"],29  "integrations": ["Caddy", "Traefik", "certbot", "acme.sh", "NGINX", "Cloudflare DNS"],30  "data_formats": ["X.509", "PEM"],31  "languages": ["Go"],32  "source_model": "open-source",33  "license_spdx": "MPL-2.0",34  "pricing_model": ["free"],35  "self_hostable": false,36  "sources": [37    { "url": "https://letsencrypt.org/", "type": "official_site", "title": "Let's Encrypt", "supports": ["name", "summary", "vendor", "pricing_model"], "checked_at": "2026-11-02" },38    { "url": "https://letsencrypt.org/docs/", "type": "official_docs", "title": "Let's Encrypt Documentation", "supports": ["capabilities", "limitations", "workflows"], "checked_at": "2026-11-02" },39    { "url": "https://github.com/letsencrypt/boulder", "type": "repository", "title": "letsencrypt/boulder", "supports": ["license_spdx", "source_model"], "checked_at": "2026-11-02", "note": "LICENSE.txt is Mozilla Public License 2.0." },40    { "url": "https://letsencrypt.org/privacy/", "type": "policy_page", "title": "Let's Encrypt Privacy Policy", "supports": ["privacy_url"], "checked_at": "2026-11-02" }41  ],42  "confidence": "high",43  "uncertainty_note": "license_spdx applies to the Boulder CA software; the CA itself is a service.",44  "discovery_method": "editorial-research",45  "depth": "deep",46  "editorial_status": "reviewed",47  "visibility": "public",48  "featured": false,49  "author": "batch-B2"50}51