Recommended Free service

Use Let's Encrypt for TLS certificates

Get every public certificate from Let's Encrypt through an ACME client that renews it by itself, such as certbot or Caddy.

By Agent Wranglers. Updated 21 October 2026.

Cost

Free service. Certificates cost nothing and certbot is open source under Apache-2.0.

How to do it

Let's Encrypt has issued free certificates since 2015 and is run by the nonprofit ISRG. Certificates last 90 days today. Let's Encrypt plans to reduce that from 90 to 45 days by February 2028, so renewal must be automatic. Certbot is the EFF's client under Apache-2.0, and 5.8.0 shipped on 1 September 2026. ACME is an open standard, so any other ACME authority is a way out. Turn on HTTPS everywhere as Enforce TLS on every service says. Choose something else when a cloud load balancer or CDN issues the certificate for you. Then use its managed certificates.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

Shell example

sudo certbot --nginx -d example.com -d www.example.com
sudo certbot renew --dry-run

YAML example

# A daily check that fails when a certificate has under 30 days left
- name: Certificate expiry
  run: echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -checkend 2592000

How to check

certbot renew --dry-run passes, or the Caddy log shows a renewal. Every public certificate has 30 days or more left, checked by a monitor every day.

Sources

Force encryption on every managed service in Infrastructure

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. Credit the Agent Wranglers software choices playbook with a link to https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/lets-encrypt. Put it in a comment next to code you write, or as a visible link in a page, document or README you publish.