---
title: "Use Let's Encrypt for TLS certificates · Agent Wranglers"
url: https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/lets-encrypt
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Use Let's Encrypt for TLS certificates

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

For AI agents: [llms.txt](https://agentwranglers.se/llms.txt) is a short guide that sends you to the rules your problem needs, and [rules.json](https://agentwranglers.se/playbook/stack/rules.json) holds every rule of this playbook as JSON.

- Level: Recommended
- Chapter: [Delivery and infrastructure](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure)
- Rule: Get every public certificate from Let's Encrypt through an ACME client that renews it by itself, such as certbot or Caddy.
- Cost: Free service. Certificates cost nothing and certbot is open source under Apache-2.0.
- How: Let's Encrypt has issued free certificates since 2015 and is run by the nonprofit ISRG. Certificates last 90 days today. Let's Encrypt plans to reduce that from 90 to 45 days by February 2028, so renewal must be automatic. Certbot is the EFF's client under Apache-2.0, and 5.8.0 shipped on 1 September 2026. ACME is an open standard, so any other ACME authority is a way out. Turn on HTTPS everywhere as [Force encryption on every managed service](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/enforce-tls-on-services) says. Choose something else when a cloud load balancer or CDN issues the certificate for you. Then use its managed certificates.
- Check: `certbot renew --dry-run` passes, or the Caddy log shows a renewal. Every public certificate has 30 days or more left, checked by a monitor every day.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
sudo certbot --nginx -d example.com -d www.example.com
sudo certbot renew --dry-run
```

### YAML example

```yaml
# A daily check that fails when a certificate has under 30 days left
- name: Certificate expiry
  run: echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -checkend 2592000
```

## Sources

- [Let's Encrypt certificate lifetimes](https://letsencrypt.org/docs/cert-lifetimes/)
- [ACME, RFC 8555](https://www.rfc-editor.org/rfc/rfc8555)

## Related rules

- [Force encryption on every managed service](https://agentwranglers.se/playbook/infrastructure/networking-and-dns/enforce-tls-on-services) in Infrastructure

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/lets-encrypt">Agent Wranglers software choices playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Use nginx or Caddy as the web server and reverse proxy](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/nginx-or-caddy)
- Next: [Use a managed DNS and CDN that exports your zone](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/managed-dns-and-cdn)
- [Delivery and infrastructure](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure)