← Back to FAQ overview
1) Are Let's Encrypt certificates trusted?
Yes. Let's Encrypt is widely trusted by browsers and operating systems. DV certificates confirm domain control only; they do not validate organization identity. For that use OV/EV certificates from a CA.
2) What are certbot rate limits?
Let's Encrypt enforces rate limits per registered domain, including duplicate certificates, failed validations, and account registrations. For repeated testing, use the staging endpoint. Use DNS-01 for automation and caching to reduce failures.
3) How does cert renewal work?
Certificates are valid 90 days. Renew when remaining lifetime is ~30 days. Caddy auto-renews using ACME. For manual flows, run certbot renew and reload the server after success.
4) Can I use the same cert for multiple domains?
Yes. Use SANs or wildcard certificates. SANs list explicit domains; wildcards like `*.example.com` cover subdomains but not the bare apex. Combine both when needed.
5) TLS 1.2 or 1.3 — what should I enable?
Enable TLS 1.3 if all clients support it; keep TLS 1.2 for compatibility if you serve older systems. Disable TLS 1.0 and 1.1. Modern servers prefer ECDSA/P-256 with X25519 key exchange.
6) How do I check my certificate details?
Use `openssl s_client -connect domain:443 -servername domain /dev/null | grep -E 'subject|issuer|not before|not after|Verify return code'`. For automation, parse the certificate with a TLS library or CLI.