Free SSL certificates, renewed automatically.

Let’s Encrypt, ZeroSSL and Google Trust Services issue SSL/TLS certificates for free, through the ACME protocol. Browsers trust them like any purchased certificate. The catch: they are valid only briefly and have to be renewed constantly. That is exactly what Acmefyer takes care of, from issuance to installation on the server.

Explore Acmefyer Documentation

01ProvidersWho issues SSL certificates for free

Free does not mean worse.

Free certificates are domain-validated (DV): the certificate authority checks that you control the domain, not who you are. The encryption is the same as with a purchased DV certificate, and browsers, mail clients and smartphones trust them just the same.

Purchased certificates add organization validation (OV, EV) and a warranty. There is no longer a difference in lifetime: since March 2026 every public TLS certificate is valid for at most 200 days, from 2029 for only 47 days, whether purchased or free.

Let’s Encrypt: Non-profit, no customer account. Certificates are valid for 90 days; Let’s Encrypt is shortening this step by step to 45 days. Since June 2025 Let’s Encrypt no longer sends expiry reminder emails.
ZeroSSL: Free via ACME with a ZeroSSL account (EAB ID and key).
Google Trust Services: Free via ACME with a Google Cloud account (EAB ID and key).
Staging: Let’s Encrypt Staging for trying things out safely, preset in Acmefyer. Browsers do not trust these certificates.

02AutomaticWhat comes after issuance

The certificate is free, replacing it costs time.

An ACME client on a single web server renews that server’s certificate. In a company network, however, many systems often depend on one name: web servers, Exchange, firewall, reverse proxy, monitoring. Acmefyer obtains the certificate in one place and distributes it to all of them, through agents on the target systems.

Renew: Hourly check, renewal 30 days before expiry, retries with growing intervals on errors.
Validate: HTTP-01, DNS-01 for around 190 DNS providers (including wildcard) and TLS-ALPN-01.
Install: IIS, Exchange, NGINX, Apache, Traefik, HAProxy, Tomcat, FortiGate and more, via agent without inbound ports.
Report: Email, Teams, Telegram, PRTG or webhook, instead of hoping for an expiry email.

03Free versionAcmefyer without a license key

Free for one domain.

1 domain with 1 subdomain or a wildcard certificate
1 agent
All features, no time limit
For more: unlimited certificates, domains and agents with the license

€299 one-time, incl. VAT, per installation, for unlimited certificates All prices and terms

04FAQFrequently asked questions about free SSL certificates

Are free SSL certificates secure?

Yes. A free certificate from Let’s Encrypt encrypts just like a purchased DV certificate, and all common browsers and operating systems trust it. The differences are organization validation (OV, EV) and the warranty, not the encryption.

How long is a Let’s Encrypt certificate valid?

90 days. Let’s Encrypt is shortening the lifetime step by step to 45 days. Acmefyer renews 30 days before expiry, no matter how long the certificate is valid.

Does Let’s Encrypt still send reminders before expiry?

No. Let’s Encrypt stopped its expiry emails in June 2025. Anyone who relied on them only notices an expired certificate when the service fails. Acmefyer renews by itself and reports every result and every error.

Do I need a Let’s Encrypt account?

No customer account. Acmefyer creates the ACME account at Let’s Encrypt itself, with an email address for important notices from the certificate authority. For ZeroSSL and Google Trust Services you need an account with the provider and enter its EAB ID and key.

Is Acmefyer itself free?

For one domain with one subdomain (or a wildcard certificate) and one agent, yes, with all features and no time limit. For more domains and agents the license costs €299 once, with no subscription.

Are there free certificates for internal names?

Not from public certificate authorities: they do not issue names such as server.corp.local or plain IP addresses. The usual approach is to give internal services a public name under your own domain, such as intranet.example.com, and obtain the certificate via DNS-01. The server does not need to be reachable from the internet for this.