Let's Encrypt (ACME)
Free, automated certificate authority that issues TLS/SSL certificates via the ACME protocol, enabling agents and automation to programmatically obtain, renew, and revoke certificates without manual intervention.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
ACME protocol with domain validation (HTTP-01, DNS-01, TLS-ALPN-01). No passwords — domain control proves identity. Rate limits prevent abuse. Non-profit CA with strong security practices. Private key management is the agent's responsibility.
⚡ Reliability
Best When
You need free, automated TLS certificate management for public-facing domains and want to eliminate manual certificate procurement and renewal entirely.
Avoid When
You need EV certificates, code signing, internal PKI, or certificates valid longer than 90 days.
Use Cases
- • Automatically issuing TLS certificates for new domain/service deployments
- • Programmatic certificate renewal before expiry in infrastructure automation
- • Wildcard certificate issuance via DNS-01 challenge for entire domain coverage
- • Certificate revocation when services are decommissioned
- • Building certificate lifecycle management into agent-driven infrastructure pipelines
Not For
- • EV (Extended Validation) certificates requiring organizational identity display
- • Code signing certificates (Let's Encrypt only issues domain validation certificates)
- • Certificates with validity longer than 90 days (LE limit; use DigiCert for longer certs)
- • Internal PKI or private network certificates (no internal hostnames or IPs)
Interface
Authentication
ACME protocol uses JSON Web Key (JWK) account keys for authentication. No traditional API keys — clients generate and manage their own key pairs. Account registration is the first step.
Pricing
Let's Encrypt is free for all users. Rate limits are generous for most use cases but can be hit during mass provisioning.
Agent Metadata
Known Gotchas
- ⚠ Certificates are only valid for 90 days — automation must handle renewal at least every 60 days
- ⚠ Rate limits are per registered domain (eTLD+1), not per subdomain — hitting limits blocks all subdomains
- ⚠ HTTP-01 challenges require the domain to be publicly reachable — won't work for internal services
- ⚠ DNS-01 challenges require DNS API access with write permissions — more complex but enables wildcard certs
- ⚠ Production and staging environments are separate — always test with staging first to avoid burning rate limits
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for Let's Encrypt (ACME).
Scores are editorial opinions as of 2026-03-06.