Frequently Asked Questions (FAQ) — by Let's Encrypt

beginnerpageLink only (©)

Answers common questions: certificates are free DV only, last 90 days (renew about every 60), the private key stays on your server, wildcards require DNS-01, and requesting a cert can attract crawler traffic because of Certificate Transparency logs.

Read the full article on letsencrypt.org

Source: Frequently Asked Questions (FAQ) by Let's Encrypt. Licence: Link only (©).

Source reviewed: 2026-11-02
Link checked: 2026-11-02
Tested hands-on: Not by Oddbyte.Me

let's encryptrenewalfaq

More in Certificates & HTTPS

Certbot User Guide — by EFF Certbot

intermediatepage

The reference for Certbot: certonly vs installer plugins, standalone/webroot/manual/DNS validation, renewal, hooks, revocation and deletion. Read the renew and hooks sections to automate reloading your web server.

Challenge Types — by Let's Encrypt

intermediatepage

Compares HTTP-01 (file on port 80), DNS-01 (TXT record at _acme-challenge) and TLS-ALPN-01. DNS-01 is the one needed for wildcards or servers that are not publicly reachable, but it needs a DNS API and narrowly scoped credentials.

Encryption modes — by Cloudflare

intermediatepage

Explains Off, Flexible, Full and Full (strict). Flexible encrypts only visitor-to-Cloudflare; Full (strict) also validates the origin certificate (public CA or Cloudflare Origin CA) and is the recommended choice.