Let's Encrypt
letsencrypt.org/docs/rate-limits/Certificate authoritydomains-dns/lets-encryptJSONcomparereport an errorprovider JSON
- Free allowance
- Free 90-day certificates including wildcards over DNS-01, with automated issuance and renewal
- Verdict
- ★ qualifiesusable as stated; the read path was probed
- Cost
- free tier
- Identity
- anonymousno card, no phone
- Binding limit
- request-rate50 certificates per registered domain per 7 days, global across all accounts, refilling at 1 per 202 minutes; 5 certificates per exact set of identifiers per 7 days; 300 new orders per account per 3 hours; 10 new accounts per IP per 3...
- Evidence
- measured4 sources; a live request was made and its output kept
- Freshness
- stale on 2027-01-21checked 2026-10-22 (live); stale on 2027-01-21
| Free tier | free 90-day certificates including wildcards over DNS-01, with automated issuance and renewal unit unlimited; metered on request-count |
|---|
| Price | none stated |
|---|
| Limits | - request-rate (binding) 50 certificates per registered domain per 7 days, global across all accounts, refilling at 1 per 202 minutes source
- request-rate (binding) 5 certificates per exact set of identifiers per 7 days source
- request-rate (binding) 300 new orders per account per 3 hours source
- request-rate (binding) 10 new accounts per IP per 3 hours source
- request-rate (binding) 5 failed authorizations per identifier per account per hour; 1,152 consecutive failures then the identifier pauses source
- retention-clamped a certificate is valid 90 days; renewal is a user's job and there is no automatic extension source
|
|---|
| Identity | anonymous no account is required to obtain a certificate; an ACME account key is generated locally and is not a registration |
|---|
| Egress | no charge |
|---|
| Per-object cap | no certificate size cap; the binding limits are rate limits and not object caps |
|---|
| Retention | a certificate is valid 90 days and must be renewed; ARI lets a client renew early (90 days) |
|---|
| Interface | rest the ACME v2 protocol at acme-v02.api.letsencrypt.org, with a staging endpoint for testing |
|---|
| Tooling | certbot, acme.sh, lego, Caddy, Traefik, any ACME client |
|---|
| Composes with | free TLS on any name you control, including a wildcard, which is what makes the free-DNS plus free-tunnel chain terminate in a valid certificate |
|---|
| Reliability | no reliability event recorded |
|---|
| Notes | The per-registered-domain limit is the one that binds a multi-tenant scheme: 50 certificates a week for every name under one registered domain, whoever requests them. The exact-identifier limit is the one that binds a retry loop, and 5 an hour is reachable in a bad afternoon. |
|---|
| Evidence note | measured the production and staging directories were fetched and answered 200 with the profile list; the rate limits are a first-party page. The 90-day validity is on the FAQ page, not on the rate-limits page it was attributed to. |
|---|
| Parsed numbers | - has-free-tier 1
- request-rate 202 minutes
- request-rate 3 hours
- request-rate 3 hours
|
|---|
Evidence 4
| date | source | what it proved |
|---|
| 2026-10-22 | probe: https://acme-v02.api.letsencrypt.org/directory | 200, 961 bytes, sha256 ee1bfe324dcd5aff6e67ba25ea98397494d5b6ebf6c7f16e98348254636190e0, listing keyChange, the classic, shortlived and tlsserver profiles, and the current subscriber agreement URL |
| 2026-10-22 | probe: https://acme-staging-v02.api.letsencrypt.org/directory | 200, 1,035 bytes; the staging endpoint is live, so an issuance test costs nothing against the production limits |
| 2026-10-22 | letsencrypt.org/docs/rate-limits/ | 50 certificates per registered domain per 7 days; 5 per exact set of identifiers per 7 days; 300 new orders per account per 3 hours; 10 accounts per IP per 3 hours; 5 failed authorizations per identifier per hour; 1,152 consecutive failures; ARI renewals are exempt from the order and per-domain limits |
| 2026-10-22 | letsencrypt.org/docs/faq/ | 'Our default certificates are valid for 90 days'; the same FAQ points at the published rationale |
Unknown values 1
- reliability note: nothing of this kind was observed