Let’s Encrypt: Free SSL Certificates with DNSimple

Last updated October 30, 2026

Table of Contents

• What makes Let’s Encrypt different
• Differences between Let’s Encrypt and Sectigo SSL certificates
• Let’s Encrypt Highlights
• DNSimple’s Let’s Encrypt integration
• DNSimple platform details
• Have more questions?

Let’s Encrypt is a free, automated certificate authority (CA) that issues domain-validated SSL certificates. DNSimple integrates with Let’s Encrypt to issue and renew these certificates for domains that resolve with DNSimple.

What makes Let’s Encrypt different

Let’s Encrypt’s three distinguishing characteristics are free, automated, and open:

• Free: Let’s Encrypt SSL certificates are free. They do not charge per certificate, making SSL encryption accessible to everyone.
• Automated: Let’s Encrypt’s issuance process is fully automated. They developed an issuance protocol called ACME (Automated Certificate Management Environment) that is designed to work without manual intervention.
• Open: The source code of Let’s Encrypt’s certification authority is completely open source and available in a GitHub account, promoting transparency and community involvement.

Differences between Let’s Encrypt and Sectigo SSL certificates

This table summarizes the most important differences between Let’s Encrypt and Sectigo SSL certificates. For a fuller comparison of what each offers at DNSimple, see Sectigo vs Let’s Encrypt SSL Certificates.

Let’s Encrypt Highlights

Let’s Encrypt is different from most traditional CAs. Here are a few notes and limitations to keep in mind before requesting one of their SSL certificates:

• Let’s Encrypt only issues domain-validated SSL certificates. There is no plan to support OV or EV certificates.
• Let’s Encrypt provides only one type of certificate: domain-validated certificates that use the Subject Alternative Name (SAN) extension. They support both single-name and wildcard names, and even certificates that protect only one hostname still use the SAN extension.
• A single Let’s Encrypt certificate can include up to 100 SAN names. Names can be single-name, wildcard names, or both.
• Let’s Encrypt certificates have a fixed expiration period of 90 days. You cannot request a certificate with a longer expiration. As of March 2026, Sectigo certificates are valid for a maximum of 200 days. For more details, see SSL Certificate Validity Changes (2026 - 2029).
• Let’s Encrypt certificates are compatible with major browsers and trusted by all major root programs.
• Let’s Encrypt certificates are domain-validated. The most common validation mechanisms are DNS-based and HTTP-based. They do not support traditional email-based validation.
• Let’s Encrypt rate-limits requests. Understand their limits before requesting a large number of certificates.

Some Let’s Encrypt capabilities may not be supported by DNSimple. Check the limitations section to learn which capabilities are supported.

DNSimple’s Let’s Encrypt integration

DNSimple automates certificate issuance and renewal, but certificate installation is still completed separately after the certificate is issued. To get started, see How to Get a Free Let’s Encrypt SSL Certificate.

Requirements for Let’s Encrypt certificates

To request an SSL certificate with Let’s Encrypt through DNSimple, the domain must be delegated to and exclusively resolving with DNSimple. Let’s Encrypt certificates are not compatible with Secondary DNS configurations because DNSimple needs to create DNS records for validation. The domain does not need to be registered with DNSimple, only resolving with it.

Automated validation process

The certificate validation is completely automated using DNS-based challenges. DNSimple automatically creates the required DNS records (ACME challenge records) for validation. Once the certificate is issued, you will receive an email and webhook notification. The certificate is then available to download from your DNSimple account. For what affects the wait, see How long does it take to issue an SSL certificate?.

Certificate expiration and auto-renewal

Let’s Encrypt certificates expire after 90 days. DNSimple supports auto-renewal for Let’s Encrypt certificates. When auto-renewal is enabled, DNSimple handles the renewal and re-validation process automatically, issuing a replacement certificate before the current one expires.

For details on how auto-renewal works, including when it runs, what happens when it fails, and how it interacts with shorter certificate lifetimes, see How Auto-Renewal Works for SSL Certificates. Renewal always issues a new certificate, as explained in How does an SSL Certificate Renewal work?, and you can also renew a Let’s Encrypt certificate manually.

DNSimple platform details

Supported capabilities

• DNS-based validation only: DNSimple supports DNS-based validation for Let’s Encrypt certificates. The HTTP-01 and TLS-ALPN-01 challenges are not supported.
• Same-domain SAN: DNSimple supports including multiple names from the same domain in a certificate’s SAN. Names from different domains cannot be included in the same certificate.
• Automatic CSR generation: DNSimple automatically generates the CSR and private key for Let’s Encrypt certificates. Custom CSRs are not supported.
• Plan-based options: On the Solo plan, a certificate covers the root domain and www. Custom names, SAN entries, and wildcard names are available on the Solo Pro plan and higher.

Limitations

DNSimple does not support all Let’s Encrypt capabilities. Some limitations exist due to design decisions or system constraints:

• Custom CSRs and private keys are not supported for Let’s Encrypt certificates
• Only same-domain names (subdomains) can be included in certificate SANs
• The domain must be resolving with DNSimple for validation to work
• Let’s Encrypt is not available in DNSimple’s sandbox environment for testing

Have more questions?

If you have additional questions or need any assistance with Let’s Encrypt certificates in DNSimple, just contact support, and we’ll be happy to help. You can also read more about SSL certificates at DNSimple.