Let's Encrypt issues over 400 million active certificates and has become the dominant choice for web encryption. For the vast majority of websites — blogs, portfolios, SaaS products, and small business sites — Let's Encrypt is the right choice. But there are specific scenarios where a paid certificate provides real additional value. This guide breaks down the honest differences.
The 90-Day Validity: Feature or Bug?
Let's Encrypt certificates expire every 90 days, which is significantly shorter than paid certificates (1–2 years). This is intentional:
- Security benefit: Compromised keys are invalidated faster. A 90-day window limits the exposure window if a private key is leaked.
- Automation benefit: Short validity forces operators to automate renewal — a system that auto-renews is more reliable than a human remembering to renew annually.
- Practical concern: If your auto-renewal breaks (server moves, DNS changes), your certificate will expire. Certbot attempts renewal when 30 days remain, giving you a 30-day window to notice and fix the issue.
# Check when your certificate expires:
echo | openssl s_client -connect yourdomain.com:443 2>/dev/null \
| openssl x509 -noout -enddate
# notAfter=Oct 14 12:00:00 2026 GMT
# Check all Let's Encrypt certificates on your system:
sudo find /etc/letsencrypt/live -name "cert.pem" \
-exec openssl x509 -in {} -noout -subject -dates \;
# Set up an email alert for expiry (add to crontab):
# 0 9 * * * certbot renew --quiet && echo "Renewed OK" | mail -s "Cert renewal" admin@yourdomain.com
Verifying Which CA Issued Your Certificate
$ openssl s_client -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -issuer
# Let's Encrypt:
issuer=C=US, O=Let's Encrypt, CN=R11
# DigiCert DV:
issuer=C=US, O=DigiCert Inc, CN=DigiCert TLS RSA SHA256 2020 CA1
# DigiCert EV:
issuer=C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV RSA CA G2
# Also check the subject to verify domain:
$ ... | openssl x509 -noout -subject
subject=CN=yourdomain.com
Rate Limits to Know
Let's Encrypt enforces rate limits that can catch you off guard during development or high-volume setups:
- 50 certificates per registered domain per week — for high-volume issuance (SaaS platforms), use their ACMEv2 API with a rate limit exemption
- 5 duplicate certificates per week — re-issuing the same domain+SANs set more than 5 times in 7 days fails
- 5 failed validation attempts per hour per account, hostname, or IP — misconfigured ACME challenges can temporarily lock you out
- Use staging environment for testing:
certbot --staging — no rate limits, but not browser-trusted
Using Let's Encrypt on Windows
Windows Server
IIS
Certbot has an official Windows installer. Alternatively, win-acme (formerly letsencrypt-win-simple) is a Windows-native tool with full IIS integration and auto-renewal via Windows Task Scheduler.
Option A: Certbot for Windows
:: Download the Certbot Windows installer from https://certbot.eff.org
:: Run installer, then from an elevated Command Prompt:
:: Use standalone mode (stop IIS first, then restart after):
net stop W3SVC
certbot certonly --standalone -d yourdomain.com -d www.yourdomain.com
net start W3SVC
:: Certificates are saved to: C:\Certbot\live\yourdomain.com\
:: fullchain.pem = cert + chain
:: privkey.pem = private key
Option B: win-acme (Native Windows / IIS Integration)
win-acme is the recommended tool for Let's Encrypt on Windows — it integrates directly with IIS and sets up automatic renewal via Task Scheduler:
:: Download win-acme from https://www.win-acme.com
:: Extract and run:
wacs.exe
:: Interactive mode — follow the prompts:
:: 1. Choose "Create certificate (default settings)"
:: 2. Choose "IIS" as the target
:: 3. Select your site from the list
:: 4. win-acme handles DNS validation, cert issuance, IIS binding, and renewal
:: For unattended/scripted renewal:
wacs.exe --renew --baseuri "https://acme-v02.api.letsencrypt.org/"
win-acme auto-renewal: win-acme creates a Windows Scheduled Task named "win-acme renewal" that runs twice daily and renews any certificate within 55 days of expiry — no cron job needed.
Using Let's Encrypt on macOS
macOS
Homebrew
# Install Certbot
brew install certbot
# Issue certificate (standalone — temporarily uses port 80):
sudo certbot certonly --standalone \
-d yourdomain.com \
-d www.yourdomain.com
# Or with Homebrew Apache (using webroot):
sudo certbot certonly --webroot \
-w /opt/homebrew/var/www \
-d yourdomain.com \
-d www.yourdomain.com
# Certificates are at:
# /etc/letsencrypt/live/yourdomain.com/fullchain.pem
# /etc/letsencrypt/live/yourdomain.com/privkey.pem
# Renew all due certificates
sudo certbot renew
# Reload Homebrew Apache/Nginx after renewal
sudo certbot renew --post-hook "brew services restart httpd"
For automated renewal, add a launchd job or use the Certbot timer installed by Homebrew:
# Homebrew creates a launchd job automatically — verify it's loaded:
sudo launchctl list | grep certbot
# Or use a cron job — add to /etc/crontab:
0 0,12 * * * root /opt/homebrew/bin/certbot renew --quiet --post-hook "brew services restart httpd"
Check your current certificate details
See which CA issued your certificate, when it expires, and whether it's configured correctly.