Free SSL Certificate Generator (Let’s Encrypt in Your Browser)

About the Free SSL Certificate Generator (Let’s Encrypt in Your Browser)

Get a real, browser-trusted SSL/TLS certificate from Let’s Encrypt without installing anything. This page is an ACME client — the protocol Let’s Encrypt uses (RFC 8555) — that runs entirely in your browser: it makes your keys with Web Crypto, creates the Let’s Encrypt account and the order, shows you exactly which file to upload or which DNS record to add for each domain, asks Let’s Encrypt to check them and then downloads the certificate chain.

The private key is made on your device and never sent anywhere, so the page makes you save it (optionally encrypted with a passphrase) before you finish: it cannot be recovered later. You can also paste your own CSR instead, so the key never leaves your server. Before you go, add the renewal date to your calendar: Let’s Encrypt sends no expiry e-mails.

Common uses

• Websites on hosting that has no automatic SSL, or where the automatic certificate stopped renewing.
• Small agencies and freelancers setting up a client’s site without shell access to the server.
• Wildcard certificates for internal-facing subdomains whose DNS is public.
• Routers, NAS boxes, mail servers and appliances that accept an uploaded certificate but cannot run a certificate client.
• Trying a certificate set-up end to end on Let’s Encrypt’s staging environment before going live.

How the page gets a certificate

• Account: a new account key (ECDSA P-256) is made in your browser and registered with Let’s Encrypt, with your agreement to the Subscriber Agreement. No e-mail address is asked for: Let’s Encrypt no longer sends expiry e-mails and no longer keeps account e-mail addresses (announcement).
• Order: the page asks for a certificate for your names. Let’s Encrypt answers with one authorization per name and the checks it accepts.
• Checks: for each name you publish a value made from Let’s Encrypt’s token and your account key’s thumbprint (RFC 8555 §8.3 and §8.4), then the page tells Let’s Encrypt it is ready, and waits for the result.
• Certificate: the page makes the certificate key and a certificate signing request (CSR) in your browser, sends the CSR — it holds only the public key — and downloads the chain. It then checks that the certificate covers exactly your names and belongs to your key.

Every request is signed with your account key (a JWS, RFC 7515). The tool talks to no outside service but Let’s Encrypt: the only addresses this page adds to its Content-Security-Policy are Let’s Encrypt’s two ACME servers (production and staging).

File on the web server or DNS record?

The file check (HTTP-01) is easiest when you can upload files to the site: Let’s Encrypt fetches http://<your domain>/.well-known/acme-challenge/<token>. It works only on port 80; Let’s Encrypt follows up to 10 redirects (to http or https on ports 80 and 443) and does not check the certificate of an https page it is redirected to, so an expired certificate does not stop it. It cannot be used for wildcard names.

The DNS check (DNS-01) works for any name whose DNS you can edit, also for wildcards and for servers that are not reachable from the internet: you add a TXT record at _acme-challenge.<your domain>. DNS changes can take a while to be seen everywhere — Let’s Encrypt mentions waiting as much as an hour — so check that the record is visible before you press Check. Several TXT records with the same name are fine; remove old ones when you are done (Let’s Encrypt: challenge types).

Which files go where

• privkey.pem — the private key (PKCS#8). It must stay secret; anyone who has it can pretend to be your site.
• fullchain.pem — your certificate followed by the intermediate certificate. nginx (ssl_certificate) and Apache 2.4.8 or later (SSLCertificateFile) want this one.
• cert.pem and chain.pem — the certificate alone and the intermediate (the “CA bundle”), for forms that ask for them separately, as most hosting control panels do.
• A .pfx file (PKCS #12) — the certificate, its chain and the private key in one file protected by a password you choose, for Windows (IIS), the Windows certificate store, Java and other servers that import a single file. The page makes it with AES-256, as current OpenSSL does by default. Servers that accept only the older Triple DES format, Azure App Service among them, need a file made with OpenSSL instead: openssl pkcs12 -export -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -macalg SHA1 -out certificate.pfx -inkey privkey.pem -in fullchain.pem (Microsoft’s instructions).

The chain comes from Let’s Encrypt with the certificate; do not use an intermediate copied from elsewhere, because Let’s Encrypt changes its intermediates from time to time.

Renewing

Let’s Encrypt certificates are short-lived on purpose — never more than 90 days — and Let’s Encrypt is shortening its default lifetime in steps, to 64 days and then 45 days (announcement); the page shows the exact lifetime of yours. Let’s Encrypt advises renewing when a third of the lifetime is left, and publishes a suggested renewal window for every certificate (ACME Renewal Information, RFC 9773); the page reads that window and puts its start in the calendar file, with a second event on the last day before expiry.

To renew, come back and go through the same steps. If you saved the account key and use it again soon, Let’s Encrypt may skip the checks your account passed recently. Where you can run software on the server, an automatic ACME client is the better choice for the long run: Let’s Encrypt lists no browser-based clients, because renewing by hand makes a missed renewal more likely (client options).

Let’s Encrypt’s limits

Let’s Encrypt limits how much one person can ask for (rate limits), among them:

• 5 failed checks per name per account per hour;
• 5 certificates per 7 days for exactly the same set of names, and 50 per registered domain;
• 300 new orders per account every 3 hours, and 10 new accounts per IP address every 3 hours.

A failed check ends its order, so this page asks you to press Check only once the file or record is live. The staging environment has much higher limits: use Test run (staging) to practise.

Limitations

• You install the certificate yourself and renew it by hand before it expires; if your host offers automatic SSL, or you can run an ACME client such as Certbot on the server, use that instead.
• Keep the tab open from the order until you have downloaded the files: the order and the keys live only in this tab, and the private key cannot be recovered afterwards.
• The file check needs port 80 open to the internet; the DNS check needs access to the domain’s DNS. Wildcard names need the DNS check.
• Domain names only, up to 100 per certificate: Let’s Encrypt issues IP address certificates only as 6-day certificates, which suit automatic renewal, not this page.
• The tool talks only to Let’s Encrypt, so it cannot test your file or DNS record before Let’s Encrypt does: open the file address or use a DNS lookup first.
• A domain whose CAA records name only other certificate authorities cannot get a Let’s Encrypt certificate until a CAA record allows letsencrypt.org.

Privacy

Your private keys — the account key and the certificate key — are made in your browser with Web Crypto and never leave it. The page sends Let’s Encrypt only what an ACME client must: the domain names, the public keys, requests signed with your account key and the certificate request (CSR). No names or keys go to MySmartCoPilot, and nothing is stored in your browser except the choices you made (real or test certificate, key type, file or DNS check).