Stop buying certificates. Start owning renewals.

What free already covers

Let's Encrypt is a nonprofit and charges nothing for its certificates.¹ It serves more than 700 million websites and issues ten million certificates on some days.² Its default certificate lives 90 days; a six-day option and certificates for IP addresses have been generally available since January 2026;³ wildcards are issued through the DNS challenge.¹ The authority tells your client when to renew through ACME Renewal Information, and renewals driven that way are exempt from its rate limits.⁴ Every mainstream ACME client speaks to it: certbot, acme.sh, Caddy, cert-manager, and the ACME support built into a growing number of servers and proxies.

So for the ordinary case, a public name on a server you control, the certificate is free, the protocol is a standard, and the authority already runs on lifetimes shorter than anything the 2029 schedule requires.⁵

Where the purchase still makes sense

Buying is not wrong. It is a decision, and it should be made per certificate, not by habit. Keep paying, or sign privately, when one of these is true:

• OV and EV. Let's Encrypt has no plans to issue organization-validated or extended-validation certificates.¹ If someone with authority over you requires the organization's name in the certificate, that is a purchase.
• S/MIME and code signing. Different certificate types, which Let's Encrypt does not issue.¹
• Client certificates. Let's Encrypt dropped the client-authentication usage from its default certificates on 11 February 2026 and stopped issuing it entirely on 8 July 2026, following Chrome's requirement to split client and server authentication into separate PKIs.⁶ Client certificates belong to a private authority anyway: you control both ends of the connection.
• Private names and addresses. A public authority may only sign a name it has validated on the public internet,⁵ so db01.internal and 10.0.0.5 need a private authority.
• Offline networks. An air-gapped network cannot reach any public authority, so it runs its own.
• Support and scale. Let's Encrypt's limits are generous, renewals through ACME Renewal Information are exempt from them, and overrides exist, but a request takes weeks.⁴ If you need a phone number, that is a product, and it costs money.

What is left when the certificate is free

Here is the part the free certificate does not touch. Every item below is your job, no matter who signs.

1. Knowing every certificate you have. The wildcard six teams share, the one a contractor installed, the vendor appliance with its own. Public ones show up in Certificate Transparency logs; the rest you have to go and find.
2. Getting the new certificate where it runs. Renewal is not done when the file lands on disk. The load balancer, the CDN, the Kubernetes secret, the appliance and the app server each take a new certificate their own way, and each is a place the old one keeps serving.
3. Proving it happened. The ticket says renewed. The endpoint says otherwise. An audit trail that records what was issued, deployed and verified, per certificate, is the difference between a renewal and a belief.
4. Owning the keys. The ACME account key and every private key sit somewhere. The automation that renews all day should never be the thing that holds them.
5. The exceptions. The certificates on the list above still need the same inventory, deployment and evidence, from a private authority or a paid one, in the same system as everything else.

How trstctl does it

trstctl is a self-hosted control plane for exactly the list above, and it is alpha software. It talks to Let's Encrypt as an ACME client: issue, renew and revoke, with unattended DNS validation through ten DNS providers, and it reads the authority's renewal window so renewals follow the CA's advice rather than a fixed cron.^7,8,9 The same one-method issuing interface drives thirteen other authorities, commercial and private, and trstctl's own private CA, so the exceptions live in the same inventory with the same audit trail.⁷ The Let's Encrypt account key never leaves the isolated signer process, and every issuing request carries an idempotency key, so a retry cannot issue twice.⁷

Two honest limits, from the documentation. The driver does not yet ask Let's Encrypt for a specific certificate profile, so it receives the default 90-day certificate today rather than the six-day one.¹⁰ And its Let's Encrypt driver is proven against a protocol-faithful test authority, not against your account, so run it against Let's Encrypt's staging environment before you trust it with production names.⁸

The issuer capability matrix lists what trstctl can do with each authority, and the console demo shows the inventory on sample data.