Get a free SSL certificate for your domain
Request a Let’s Encrypt TLS certificate through KByte using a DNS record or a verification file. Generate a private key and certificate signing request in your browser, prove domain control, then download the certificate files for your hosting. Your private key stays on your device.
Start your certificate request. You need access to your domain’s DNS settings or the website’s public files, and a hosting service that lets you install a certificate. If your host already offers automated Let’s Encrypt certificates, that option is usually simpler to maintain.
What this free SSL certificate tool includes
- Requests for one to five domain names on a certificate.
- DNS TXT validation, including wildcard requests.
- HTTP file validation for individual domain names.
- Private-key and CSR generation on your device, or the option to use your existing CSR.
- A downloadable certificate, intermediate chain and full-chain PEM file after successful validation.
The certificate is issued by Let’s Encrypt, not by KByte. Issuance depends on successful validation and the certificate authority’s policies and rate limits. A certificate protects the connection to your website; it does not certify the quality of your business or remove malware.
Choose DNS validation or file validation
For a DNS validation SSL certificate, add the TXT name and value shown by the tool to your DNS provider. Wait until the change is publicly available before asking Let’s Encrypt to validate it. If your request needs two TXT values at the same name, keep both until validation finishes.
For file validation, upload the supplied file at the exact path shown under /.well-known/acme-challenge/. Let’s Encrypt must be able to reach it publicly over HTTP on port 80. A login page, blocked connection or incorrect file contents can prevent validation.
A free wildcard SSL certificate requires DNS validation. A name such as *.example.com covers immediate subdomains such as www.example.com; it does not cover example.com itself. Add the base domain separately if you need it. Let’s Encrypt does not use approval emails sent to admin or postmaster addresses. See its domain validation guidance.
Save your private key and install the certificate
The private key is generated in your browser and is not uploaded to KByte. Download it before continuing, store it securely and do not send it in email or a support form. The certificate files need the matching key to work. If you lose it, generate a new key and request a new certificate.
After issuance, follow your hosting provider’s instructions to install the certificate and chain with your saved private key. Some hosts accept separate files; others use a full-chain file. Save the existing configuration and agree a recovery route before changing a live website.
Check HTTPS on the exact names included in your certificate, including www if you use it. Confirm that the chain is accepted, that pages load without mixed-content warnings and that any HTTP-to-HTTPS redirects behave as intended. Downloading files from this page does not install them on your server.
Plan renewal before the certificate expires
Let’s Encrypt certificates are free to renew; this is not a three-month trial. Certificate lifetimes are becoming shorter. Use the expiry shown on the issued certificate rather than assuming a fixed number of days. Let’s Encrypt has announced a 64-day default lifetime from 10 February 2027.
This browser tool does not automatically renew or reinstall a certificate. An ACME client integrated with your hosting or DNS provider is the better choice for unattended renewals. If you use this tool manually, return before expiry to request and install a replacement. KByte does not send expiry reminders through this tool.
Get help with installation
If your host does not provide clear installation controls, ask it whether custom certificates are supported before creating a request. KByte can discuss website configuration through our website development service or WordPress support service. Consultancy is always free of charge; installation or ongoing work is agreed separately before paid work begins.
Requests remain accessible in the same browser for up to 24 hours. Save the key and certificate files rather than relying on this page as storage. Read the certificate tool privacy information and terms before requesting a certificate.