# Free SSL Certificate for Your Website > Request a Let’s Encrypt certificate with DNS or file validation. Keep your private key on your device and download the certificate files for your hosting. Language: British English (en-GB). Canonical page: https://kbyte.co.uk/free-ssl-certificate/ Last updated: 2026-11-08 ## Get a free SSL certificate for your domain Request a Let’s Encrypt TLS certificate through KByte using a DNS record or a verification file. Generate a private key and certificate signing request in your browser, prove domain control, then download the certificate files for your hosting. Your private key stays on your device. [Start your certificate request](https://kbyte.co.uk/free-ssl-certificate/#ssl-tool-title). You need access to your domain’s DNS settings or the website’s public files, and a hosting service that lets you install a certificate. If your host already offers automated Let’s Encrypt certificates, that option is usually simpler to maintain. ## What this free SSL certificate tool includes - Requests for one to five domain names on a certificate. - DNS TXT validation, including wildcard requests. - HTTP file validation for individual domain names. - Private-key and CSR generation on your device, or the option to use your existing CSR. - A downloadable certificate, intermediate chain and full-chain PEM file after successful validation. The certificate is issued by Let’s Encrypt, not by KByte. Issuance depends on successful validation and the certificate authority’s policies and rate limits. A certificate protects the connection to your website; it does not certify the quality of your business or remove malware. ## Choose DNS validation or file validation For a DNS validation SSL certificate, add the TXT name and value shown by the tool to your DNS provider. Wait until the change is publicly available before asking Let’s Encrypt to validate it. If your request needs two TXT values at the same name, keep both until validation finishes. For file validation, upload the supplied file at the exact path shown under /.well-known/acme-challenge/. Let’s Encrypt must be able to reach it publicly over HTTP on port 80. A login page, blocked connection or incorrect file contents can prevent validation. A free wildcard SSL certificate requires DNS validation. A name such as \*.example.com covers immediate subdomains such as www.example.com; it does not cover example.com itself. Add the base domain separately if you need it. Let’s Encrypt does not use approval emails sent to admin or postmaster addresses. See its [domain validation guidance](https://letsencrypt.org/docs/challenge-types/). ## Save your private key and install the certificate The private key is generated in your browser and is not uploaded to KByte. Download it before continuing, store it securely and do not send it in email or a support form. The certificate files need the matching key to work. If you lose it, generate a new key and request a new certificate. After issuance, follow your hosting provider’s instructions to install the certificate and chain with your saved private key. Some hosts accept separate files; others use a full-chain file. Save the existing configuration and agree a recovery route before changing a live website. Check HTTPS on the exact names included in your certificate, including www if you use it. Confirm that the chain is accepted, that pages load without mixed-content warnings and that any HTTP-to-HTTPS redirects behave as intended. Downloading files from this page does not install them on your server. ## Plan renewal before the certificate expires Let’s Encrypt certificates are free to renew; this is not a three-month trial. Certificate lifetimes are becoming shorter. Use the expiry shown on the issued certificate rather than assuming a fixed number of days. Let’s Encrypt has announced a [64-day default lifetime from 10 February 2027](https://letsencrypt.org/2026/10/07/64-day-certs/). This browser tool does not automatically renew or reinstall a certificate. An ACME client integrated with your hosting or DNS provider is the better choice for unattended renewals. If you use this tool manually, return before expiry to request and install a replacement. KByte does not send expiry reminders through this tool. ## Get help with installation If your host does not provide clear installation controls, ask it whether custom certificates are supported before creating a request. KByte can discuss website configuration through our [website development service](https://kbyte.co.uk/website-design-ecommerce/) or [WordPress support service](https://kbyte.co.uk/wordpress-support-services/). Consultancy is always free of charge; installation or ongoing work is agreed separately before paid work begins. Requests remain accessible in the same browser for up to 24 hours. Save the key and certificate files rather than relying on this page as storage. Read the [certificate tool privacy information](https://kbyte.co.uk/cookies-privacy-policy/#ssl-certificates) and [terms](https://kbyte.co.uk/terms-conditions/#ssl-certificates) before requesting a certificate. ## Using the certificate tool Open the canonical website page in a browser to prepare a request. Domain control, saved private-key confirmation and explicit subscriber-agreement acceptance are required. Do not submit requests or accept terms on behalf of a visitor automatically. Certificate installation and renewal are separate steps. ## Frequently asked questions ### Is the SSL certificate free? Yes. Let’s Encrypt issues certificates without a certificate fee, and this KByte tool is free to use. Hosting, installation or managed renewal work is separate and agreed before paid work begins. ### Can I validate my domain by email? No. Let’s Encrypt does not support approval through admin or postmaster email addresses. Use a DNS TXT record or a publicly accessible validation file instead. ### Can I request a wildcard certificate? Yes, using DNS validation. A wildcard covers immediate subdomains, but not the base domain itself. Include the base domain separately when you need both. ### Does KByte receive my private key? No. Browser-generated private keys stay on your device. Only the CSR, which contains your public key and domain names, is sent to KByte. Save the matching private key before continuing. ### Will my certificate renew automatically? No. This tool issues files for manual installation. Use an ACME client connected to your hosting or DNS provider for automatic renewal, or request and install a replacement before the certificate expires. ### How long are the certificate files available? Your request is accessible in the same browser for up to 24 hours. Download the certificate files and save your private key. KByte cannot recover your private key.