Questions, answered.
The practical details behind your certificate, your keys, and your next secure connection.
Is this SSL really free?
Yes. Let's Encrypt issues certificates for free, and this service does not require a payment or subscription. You need control of a public domain and a way to update its DNS or web server.
Are Let's Encrypt certificates trusted?
Production certificates are trusted by modern browsers and operating systems. Staging certificates are for testing and are deliberately not trusted. The generator clearly identifies staging mode.
Do I need an account?
No. There is no login, registration, user profile, or dashboard account. Your temporary certificate order is associated with a secure ownership cookie in your browser.
Do I need to create a Let's Encrypt account?
No. The site operator manages one ACME account on the server. It is created automatically from the operator's configuration. You do not need a CA dashboard or third-party API key.
Can I generate a wildcard certificate?
Yes. Enter *.example.com. A wildcard covers one level of subdomains, such as app.example.com, but not the root domain or nested names such as a.b.example.com. Add example.com separately if you need it.
Why does a wildcard require DNS verification?
Let's Encrypt requires DNS-01 for wildcard identifiers. You must publish the requested TXT value under _acme-challenge. If several challenges use the same name, publish all values at once as separate TXT records.
How long is the certificate valid?
Let's Encrypt issues short-lived certificates, and its validity policies can change. The result screen and certificate files show the actual expiration date returned by the CA. This service does not automatically renew or install certificates.
What is cert.pem?
It is the leaf certificate for your domain names. It contains the public key and the CA's signature, not your private key.
What is fullchain.pem?
It contains your leaf certificate followed by the intermediate certificates needed to build the trust chain. Nginx and many modern servers expect this file.
What is chain.pem?
It contains intermediate CA certificates without your leaf certificate. Some hosting panels ask for it as a CA bundle. A trust root is generally not sent by your web server.
What is privkey.pem?
It is the private key matching your certificate. Keep it secret, restrict its permissions, and never put it in a public web directory or source-control repository.
Do you store my private key?
Your certificate private key is generated with Web Crypto in your browser and held in component memory. It is not sent to our server, Redis, analytics, localStorage, or sessionStorage. Download it before navigating away or refreshing. The server separately stores its own ACME account key.
Why is my DNS record not detected yet?
DNS propagation and cached records can delay detection. Check the exact record name, all TXT values, authoritative DNS provider, and whether your provider appends the domain name automatically. Local detection does not guarantee Let's Encrypt can see the record from its validation locations.
What happens when the order expires?
Temporary order data expires automatically, normally after 30 minutes. The timer shows the configured lifetime. Create a new request after expiration. Downloaded certificates remain valid until their own expiration date.
Can I close this tab and come back later?
Not without losing the in-memory certificate key and wizard state. Keep the tab open and download the private key as a backup. Refreshing requires a new request through this interface. No key recovery service exists.
Why did HTTP verification fail?
The exact challenge URL must return the expected content on port 80, without login. Check IPv4 and IPv6 routing, firewalls, caching, and rewrite rules. This service follows only same-host redirects, and HTTPS redirects require a valid trusted certificate.
Is this service officially affiliated with Let's Encrypt?
No. This is an independently operated interface to the Let's Encrypt ACME service. Let's Encrypt's subscriber agreement, issuance policies, and rate limits apply.
Will the certificate renew automatically?
No. Generate and install a replacement before expiry, or use a maintained automated ACME client such as Certbot on your server. Automated renewal is recommended for long-running production websites.