Engineering Glossary · Transport Security
Let's Encrypt: Renewal Fails Quietly Until the Padlock Goes
Nothing announces a failed renewal at day 60; you find out at day 90 when every visitor meets a full-page browser warning at once.
The short answer
Let's Encrypt is the automated certificate authority that made HTTPS free and universal, issuing short-dated certificates over the ACME protocol that renew without anybody involved.
The operational risk is not issuance, it is the silent renewal failure. ACME proves you control the domain by setting a challenge; if anything blocks the answer to that challenge — a redirect rule, a firewall, a proxy, DNS that has moved — the renewal simply does not happen. There is no visible symptom until the certificate lapses, so the thing worth monitoring is the expiry date on the live endpoint rather than the renewal job's own opinion of itself.
By the HostingFast team · Reviewed 12 August 2026
0
Jargon left undefined
100+
Entries, all cross-linked
Real
Working examples
Free
To read, always
Its ACME protocol lets a server prove domain control and collect a certificate with nobody involved at any stage. With that automated, encryption costs nothing and asks for no administration either. Ninety-day lifetimes are intentional: they keep the renewal machinery exercised and working.
It powers almost every host's free SSL, including ours. The certificates it issues carry full browser trust and are identical in strength to a paid domain-validated one.
How the challenge is actually answered
There are two mechanisms in ordinary use. The http-01 challenge places a token file under /.well-known/acme-challenge/ on your site and the authority fetches it over plain HTTP on port 80. The dns-01 challenge publishes a TXT record under _acme-challenge and the authority resolves it — slower, but the only route that can issue a wildcard.
Knowing which one your setup uses tells you where to look when it stops working. If it is http-01, the question is whether that path is reachable from outside; if it is dns-01, the question is whether the automation still has permission to write records at whoever now hosts your zone.
The four things that break a renewal
A blanket redirect is the most common: a rule sending everything to HTTPS, or to index.php, that catches /.well-known/acme-challenge/ along with it. A firewall or security plugin blocking the authority's request is the second. A proxy or CDN in front of the origin answering on port 80 instead of your server is the third. DNS pointed somewhere else entirely — often after a migration nobody finished — is the fourth.
Test the path yourself rather than trusting the renewal log. Drop a file at /.well-known/acme-challenge/test.txt and fetch it with curl over plain http from outside the network. If that returns your file with a 200, the challenge path is clear and the fault is elsewhere. If it returns a 301 or a 403, you have found it in under a minute.
Why ninety days is the feature
A short lifetime forces the automation to exist and to run often enough that its failures are discovered while they are still cheap. A certificate renewed annually is renewed by a person who has forgotten how, using a process last exercised twelve months ago; one renewed every sixty days is renewed by a mechanism that either works this month or told you it did not.
It also limits the value of a stolen key. A certificate that ages out in weeks is worth far less to an attacker than one with a year left on it, which is the security half of an argument usually presented as a convenience.
Where this lands on HostingFast
Free SSL on every plan is issued and renewed automatically, so on shared hosting this machinery is ours to keep running rather than yours to remember. Point a new domain at us and a browser-trusted certificate exists within minutes, already queued for renewal.
Read next: SSL Certificate for the credential itself, HTTPS for what runs on top, TLS for the handshake, and Wildcard SSL for the case that forces the DNS challenge.
A hundred terms, each with the mechanism
Every entry here started life as a support ticket. Rather than explain the same term for the two hundredth time, we wrote it down properly — with the challenge path, the failure list and the check that takes a minute.
NVMe storage and LiteSpeed caching power every tier, from the smallest plan up — speed is the baseline here, not an upsell.
- 100+ entries, each with the mechanism spelled out
- Commands you can paste, numbers you can compare against
- Neighbouring terms wired together at the foot of every page
- Written by the engineers who answer the tickets
Why HostingFast
Standard on every plan
Silent failures flagged
A renewal that stops has no symptom until the day it matters, so the entry says what to monitor instead of the job log.
Failure lists, not vague advice
Four specific causes for a broken renewal, each with the check that confirms or eliminates it.
Mechanism, not vocabulary
http-01 against dns-01, and what each one implies about where to look when it stops.
Design intent explained
Ninety days is a deliberate choice with two reasons behind it, both of which change how you should operate it.
Wired to its neighbours
Let's Encrypt runs into SSL Certificate, HTTPS, TLS and Wildcard SSL — the same subject at four levels.
This term, landed
ACME defined, its challenges distinguished and its failure modes listed — enough to debug a renewal today.
Quick Start
From order to online
- 1
Establish which challenge is in use
http-01 fetches a file over port 80; dns-01 resolves a TXT record. The answer decides which half of the stack you investigate.
- 2
Prove the challenge path is reachable
Put a file at /.well-known/acme-challenge/test.txt and fetch it over plain http from outside. A 301 or 403 is the fault, found in a minute.
- 3
Monitor the live expiry date
Check notAfter on the endpoint itself on a schedule. The renewal job's own log is not evidence that a visitor sees a valid certificate.
Built In
Loaded onto every plan
- Free SSL on every plan, renewed automatically before it can lapse
- Certificates issued within minutes of a domain pointing at us
- cPanel, so certificate status is visible without a ticket
- NVMe SSD storage on every tier, not only the expensive ones
- Real SSH, plus Git and Composer, on the developer-focused plans
- Browser webmail plus IMAP, POP and SMTP for any mail client
- Your existing site moved over by our engineers, free of charge
- Upgrades applied in place — changing plan is not a migration
- A renewal price identical to the one you signed up at
- Softaculous on board for one-click application installs
Frequently Asked
What people ask us most often
Why would an automatic renewal stop working?
Four causes cover nearly all of it: a blanket redirect or rewrite rule catching /.well-known/acme-challenge/, a firewall or security plugin blocking the authority's request, a proxy answering on port 80 instead of your origin, or DNS that has been pointed elsewhere. Test by placing a file under that path and fetching it over plain http from outside — a 301 or 403 identifies the cause immediately.
Which challenge type does a wildcard certificate require?
dns-01. A wildcard cannot be validated by serving a file, because there is no single hostname to serve it from, so the authority checks a TXT record under _acme-challenge instead. That means your automation needs write access to the DNS zone, which is the practical constraint people run into when the zone lives somewhere the issuing system cannot reach.
Is a free certificate cryptographically weaker than a paid one?
No. Same ciphers, same browser trust, same padlock — a client cannot tell them apart and neither can a scanner grading your endpoint. What a paid certificate adds is organisational vetting, warranty cover and easier wildcard handling. Those are procurement features rather than a stronger lock.
How long is the money-back window?
Thirty days on shared, business, WordPress and WooCommerce hosting; seven on reseller. VPS and dedicated servers are provisioned to order the moment payment lands, so they sit outside the guarantee — as do domain registrations, where the registry charges the instant the name is secured. Inside the window, one request returns your hosting fee.
Keep reading
HTTPS
What ACME actually issues, and the chain checks worth running once it has.
Wildcard SSL
The subdomain case that forces the DNS challenge, and what the asterisk does not cover.
Best Let's Encrypt vs Paid SSL
The same call made as a buyer's guide: what to verify, what to ignore, and the plan we would sign.
Drupal Hosting
Drupal with Composer, Drush and per-site PHP control on tap.
Web Hosting
Fast cPanel hosting on NVMe drives — SSL, migration and a year-one domain all included.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Renewal you never have to think about.
Free SSL issued within minutes and renewed automatically, NVMe on every tier, and support that will read a challenge log with you.
View Drupal Hosting plans