Skip to content
sslcertificates.io
Sign in Start free

Setup guide

Let's Encrypt on sslcertificates.io

Let's Encrypt is one certificate authority.

Official endpoints

Environment Customer mode ACME directory
Test Test mode https://acme-staging-v02.api.letsencrypt.org/directory
Live Live mode https://acme-v02.api.letsencrypt.org/directory

Source: ACME protocol updates.

Trust

  • Test / Staging: real ACME, real validation, not publicly trusted.
  • Live / Production: publicly trusted DV certificates.

ACME accounts

The platform maintains one managed Let's Encrypt account per environment:

  • LE_TEST_ACCOUNT for Staging
  • LE_LIVE_ACCOUNT for Production

Account keys are encrypted. Staging state is never reused for Production. This follows Let's Encrypt guidance for larger integrators: one account, guarded carefully, rather than many accounts created to bypass limits.

You do not paste a Let's Encrypt API token.

How issuance works

  1. Authorize the organization and plan entitlements.
  2. Persist the order (environment is immutable).
  3. Enqueue on letsencrypt:test or letsencrypt:live.
  4. Return 202 Accepted. HTTP controllers do not call newOrder.
  5. A worker obtains shared provider capacity, then talks to Let's Encrypt.

If your plan is over its issuance rate, the API returns 429 PLAN_ISSUANCE_RATE_LIMIT with Retry-After. Waiting for Let's Encrypt capacity is not a 429 — the order stays queued.

Test vs Live

See /docs/environments. Test isolates sslcertificates.io resources. It does not mean third-party APIs are simulated. DNS-01 against Cloudflare or Route 53 in Test can create real TXT records in the zone you configure.

Do not deploy a Test / Staging certificate to a Live production target.

Rate limits

See /docs/integrations/certificate-authorities/lets-encrypt/rate-limits.

Promotion

Do not convert a Test certificate into a Live certificate. Repeat the verified workflow with a Live API key (sk_live_…) when you need a publicly trusted leaf.

Emergency Live kill switch

Live issuance is enabled in normal operation. An Admin-only emergency control can disable Let's Encrypt Live during an incident. Customers then see: “Let's Encrypt Live issuance is temporarily unavailable.” That is not the default product state.

Related

  • Environments: /docs/environments
  • Rate limits: /docs/integrations/certificate-authorities/lets-encrypt/rate-limits
  • Quickstart: /docs/quickstart

Continue

Back to Let's Encrypt Create account