# Let's Encrypt 172 Hacker News commenters recommended Let's Encrypt and 89 criticized it, November 2025 to November 2026. It was recommended in 12 of 13 months; owners who said how long report a median of 5.5 years (6 owners). **Verdict:** Free, automated TLS certificates that are widely trusted and made HTTPS the default; critics worry about it becoming a US-controlled single point of failure and about shrinking certificate lifetimes. ## Why people recommend it - Helped encrypt most of the web (6 comments): "Google was able to push these requirements in large part due to Let's Encrypt's success making secure origins ubiquitous." ([source](https://news.ycombinator.com/item?id=46209748)) "That one non-profit has almost single-handedly encrypted most of the web, 700 million sites now! Amazing work." ([source](https://news.ycombinator.com/item?id=46142411)) "They made TLS the default, so much that you didn't have to keep unencrypted HTTP around any more." ([source](https://news.ycombinator.com/item?id=46142509)) - Free certificates, no commercial CA (6 comments): "without paying any money, registering a domain, configuring DNS or disclosing any personally identifiable information" ([source](https://news.ycombinator.com/item?id=47348174)) "Thanks to Let's Encrypt, otherwise I would have had to manually purchase or apply for a free certificate" ([source](https://news.ycombinator.com/item?id=46132110)) "Letsencrypt is a great example, it did took away the big money from all these commercial CA's" ([source](https://news.ycombinator.com/item?id=49743538)) - Automated setup and renewal (4 comments): "My personal experience with Let's Encrypt has been that the only hassle is in systems that don't implement automation" ([source](https://news.ycombinator.com/item?id=46128994)) "I simply ran the script provided by LE, it set everything up, and it renewed every time until I took the site down" ([source](https://news.ycombinator.com/item?id=46281879)) "LE has been an amazing resource and every time I setup a new website and get a LE cert I smile." ([source](https://news.ycombinator.com/item?id=46210855)) - DNS challenge for internal hosts (2 comments): "Thanks to LetsEncrypt DNS-01, you can absolutely spin up a production-like environment with SSL and everything." ([source](https://news.ycombinator.com/item?id=46337636)) "You can get a free cert from letsencrypt using their dns challenge. No need to expose to the internet." ([source](https://news.ycombinator.com/item?id=45956513)) ## What people warn about - Central point of failure, political risk (6 comments): "Let's Encrypt could stop issuing certificates to you, if the administration decided that necessary." ([source](https://news.ycombinator.com/item?id=46220200)) "There is no technical guarantee that this remains the case indefinitely, only a political one." ([source](https://news.ycombinator.com/item?id=46209817)) "as soon as you transact with a sanctioned entity, you are globally in breach of the agreement and risking the revocation of all your certificates" ([source](https://news.ycombinator.com/item?id=48458234)) - Shorter lifetimes and breaking changes (4 comments): "Lets Encrypt hasn't even existed for a full decade yet. During that time it's dropped support entirely for the original acme protocol." ([source](https://news.ycombinator.com/item?id=47433488)) "Free providers have limits and this new time limitation will also play into that as there will be many more certificates to renew." ([source](https://news.ycombinator.com/item?id=46281964)) "The same let's encrypt that recently removed support for using their certificates in clients because Google told them to?" ([source](https://news.ycombinator.com/item?id=47702219)) - Domain validation challenges are awkward (5 comments): "its a bit of a palava. I don't have to open port 80 which is nice for ... security audits but gains zero security benefit." ([source](https://news.ycombinator.com/item?id=47069134)) "You could have HTTPS with Letsencrypt, but you need to deactivate Cloudflare when you want to renew" ([source](https://news.ycombinator.com/item?id=46210609)) "It’s a stupid policy. To solve the non-existent problem with certificates, we are pushing the problem to demonstrating that we have access to a DNS registrar’s service portal." ([source](https://news.ycombinator.com/item?id=46281371)) ## Alternatives hackers recommend - [ZeroSSL](https://hackerapproved.com/p/zerossl.md): 12 recommend - [Sectigo certificate](https://hackerapproved.com/p/sectigo.md): 5 recommend ## Where to get it - [Visit the official site](https://letsencrypt.org/) ## Cite as Hacker Approved, "Let's Encrypt", https://hackerapproved.com/p/let-s-encrypt/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).