Bridge SSL
Let's Encrypt alternative: when you actually need one
You need a Let's Encrypt alternative when a requirement asks for something Let's Encrypt does not offer: organisation or extended validation, a support contract, a different certificate lifetime, or more issuance than its rate limits allow [1] [3]. If the site needs a domain-validated certificate and something can run an ACME client for it, Let's Encrypt does the job and charges no fee for the certificate [1] [2]. A paid certificate gives the same assurance about the domain name [4]. The criteria that apply to any authority are on the page that helps you compare certificate authorities.
- Validation
- domain validation only; no organisation or extended validation, and no plans to issue them [1]
- Fee
- none for the certificate [1]
- Support
- documentation and community forums, no direct support [1]
- Lifetime
- set by Let's Encrypt, with no way to adjust it and no exceptions [1]
- Rate limits
- published, and designed so that renewing a certificate almost never hits one [3]
- Longest validity, any authority
- 200 days for a publicly trusted TLS server certificate issued from 15 March 2026 [4]
Where Let's Encrypt is stronger
For a domain-validated certificate, five things favour Let's Encrypt.
No fee. Let's Encrypt is a nonprofit and does not charge for its certificates [1]. A hosting provider may still charge a nominal fee for providing them [1].
Issuance with no person involved. Let's Encrypt issues through an API based on the ACME protocol, and an ACME client, run by you or your hosting provider, gets the certificate [2].
The private key stays with you. It is generated and managed on your own servers, never by Let's Encrypt [1].
Clients to choose from. Let's Encrypt points to a large number of ACME clients and recommends starting with Certbot [1].
Browser trust. Let's Encrypt answers "for most browsers and operating systems, yes" and publishes a compatibility list [1].
A reason to leave has to come from a requirement that these do not meet.
When you need a Let's Encrypt alternative
Four requirements send you to another authority, and each can be checked before you buy:
| Your requirement | What Let's Encrypt offers | What the alternative has to provide |
|---|---|---|
| A policy or contract names OV or EV | domain validation only, no plans for OV or EV [1] | organisation checks: identity and address verified, for example through a government agency or a site visit [4]; see certificate types |
| Someone under contract must answer during an incident | documentation and community forums [1] | a paid arrangement with an obligation to respond |
| A device accepts certificates only by hand | a lifetime it does not adjust for anyone [1] | a longer validity, which no publicly trusted authority can stretch past the Baseline Requirements maximum [4] |
| Many new certificates for many hostnames | published rate limits; a large hosting provider can ask for higher ones through a form [3] | a second authority to issue from, or higher limits granted on request |
If no row fits, stay with Let's Encrypt.
The device row has a limit of its own. The maximum validity period of a publicly trusted TLS server certificate is 200 days if issued from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029, whoever issues it [4]. A longer-lived certificate means fewer manual replacements, and the cap falls at each step.
Reasons that are not reasons
Four arguments for leaving Let's Encrypt do not hold up against the sources.
"Free certificates are less trusted." The Baseline Requirements say that all certificate types provide the same level of assurance of the device identity, the domain name or IP address [4].
"A paid certificate is more secure." Client and server establish the keys and select the cryptographic parameters in the TLS handshake [6]. The authority that signed the certificate does not choose them.
"Short lifetimes are risky." Let's Encrypt gives two reasons for them: they limit the damage from key compromise and mis-issuance, and they encourage automated renewal [5]. The Baseline Requirements are shortening the maximum for every authority [4].
"You get what you pay for." What you pay for is validation depth, support and terms, not a stronger certificate. What the cost of SSL certificates covers has a page of its own.
Switching from Let's Encrypt to another ACME authority
If the new authority speaks ACME, switching is mostly a client setting. If no ACME client runs yet, that is the real work: choose an ACME client first.
Point the client at the new directory URL. A client needs only the directory URL; the directory lists every other address [7].
Check whether the new authority requires external account binding. If the directory says
externalAccountRequired, the authority gives you a key identifier and a MAC key outside ACME; the client signs a binding with the MAC key and sends it with the key identifier [7].Create an account with the new server. The client sends a request to the server's newAccount URL [7].
Update the CAA record. If your domain publishes CAA records, an authority must not issue unless the request is consistent with them or its CP or CPS names an exception, and one issue record names one authority [10]. Let's Encrypt's example is
example.org CAA 0 issue "letsencrypt.org"[11]; add a second issue record with the domain name the alternative lists in its policy documents [4] [10].Install the chain that comes with the new certificate. By default, ACME delivers the certificate and its issuer certificates in one file [7]; install that file, not the chain kept from Let's Encrypt.
What a support contract changes
A support contract buys an obligation to respond, and its value depends on where your incidents happen.
At the authority. Issuance fails, validation behaves unexpectedly, a certificate must be revoked in a hurry. A contract gives you a party obliged to look.
On your side. A server that sends an incomplete chain, a configuration that was never reloaded, a renewal that stopped running. The authority's support cannot change your server, so a contract does not shorten these.
If your organisation must name an accountable party during any incident, wherever the fault lies, that requirement is organisational, and it is a fair reason to pay.
Other ACME authorities
Leaving Let's Encrypt does not have to mean leaving automation. ZeroSSL issues certificates through ACME at no charge, stores each certificate in your ZeroSSL account and requires external account binding credentials from its dashboard [8]; how the two compare is in ZeroSSL vs Let's Encrypt. Google Cloud's Public CA issues publicly trusted certificates through ACME to clients that support external account binding, with a key created in a Google Cloud project [9].
Where the requirement is organisation validation or a support contract, the field is commercial SSL certificate providers, and the same criteria for choosing an authority apply to each of them.
Bridge SSL and the choice of authority
Bridge SSL is the certificate layer of Bridge CDN. It covers domain-validated certificates, issued and renewed where the site is served, and the *.example.com wildcard when the domain's DNS is on Bridge DNS [12]. The issuing authority is the platform's decision, not a setting, and there is no certificate upload [12]. If you need an OV or EV certificate, or an authority your compliance regime names, this layer does not fit [12]; the table above shows what to look for instead. Current terms live where signup does, on Bridge CDN.
FAQ
Do I need an alternative to Let's Encrypt?
Can I get an OV or EV certificate from Let's Encrypt?
No. Let's Encrypt offers domain-validated certificates only, says it cannot automate issuance for OV and EV, and has no plans to issue them. [1]
Does Let's Encrypt issue wildcard certificates?
Yes, through the DNS-01 challenge only, so the client has to be able to write a TXT record in your DNS. The steps are on the page about getting a Let's Encrypt wildcard SSL certificate. [1] [7]
What about Let's Encrypt rate limits?
Let's Encrypt publishes them and designs them so that renewing a certificate almost never hits one. They matter when many new certificates are requested; a large hosting provider can ask for higher limits through a form. The current figures are on its rate limits page. [3]
How long can a certificate from an alternative be valid?
No longer than the Baseline Requirements allow for every publicly trusted TLS server certificate: 200 days if issued from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. [4]
Sources
Let's Encrypt, FAQ: services, cost, support, browser trust, private keys, certificate lifetimes, OV and EV, wildcards, ACME clients.
Let's Encrypt, Getting Started: issuance through an API based on ACME, an ACME client run by you or your hosting provider.
Let's Encrypt, Rate Limits: purpose, renewals, requesting an override.
CA/Browser Forum, Baseline Requirements for TLS Server Certificates (version 2.3.1): §3.2.2.1 organisation identity, §4.2.2.1 CAA record processing, §6.3.2 validity periods, §7.1.2.7.1 certificate types.
Let's Encrypt blog, Josh Aas (ISRG): why Let's Encrypt chose short certificate lifetimes.
RFC 9846, The Transport Layer Security (TLS) Protocol Version 1.3: §2.
RFC 8555, Automatic Certificate Management Environment (ACME): §7.1.1 directory, §7.3 account creation, §7.3.4 external account binding, §7.4.2 downloading the certificate, §8.4 DNS challenge.
ZeroSSL, ACME documentation: certificates at no charge, storage in the ZeroSSL account, EAB credentials.
Google Cloud, Certificate Manager: request a certificate using Public CA and an ACME client.
RFC 8659, DNS Certification Authority Authorization (CAA) Resource Record: §3, §4.2.
Let's Encrypt, Certificate Authority Authorization (CAA).
Bridge SSL, home page: Covers; Is this you; Four things this deliberately does not do; Where Bridge SSL sits.