Issue with Let's Encrypt

Let's Encrypt issues free DV certificates in an automated way via the ACME v2 protocol.

---

Prerequisites

• Access with ADMIN or OPERATOR role
• Publicly accessible domain (for HTTP validation) or access to the DNS zone (for manual DNS validation)
• For automatic DNS validation: AWS integration with Route 53 configured

---

Step 1 — Configure the Let's Encrypt integration

1. Go to Integrations in the sidebar menu
2. Find the Let's Encrypt card and click + Configure
3. Fill in the fields:
   • Name — e.g.: letsencrypt-production
   • Email — will receive notifications from Let's Encrypt about the account
   • Account type — Staging for testing or Production for real certificates
4. Click Create
5. Click Check Status to confirm the connection is working

Use Staging first

The Staging environment has no request limits and does not issue certificates trusted by browsers. Ideal for testing the flow before using Production.

---

Step 2 — CSR Step 2: CA and Configuration

1. Under Certificate Authority, select Let's Encrypt (Automated issuance)
2. Under Let's Encrypt Account, choose the account registered in Step 1
3. Choose the validation method:

Method	When to use
HTTP Challenge	You have access to the domain's web server
DNS Challenge (Manual)	You have access to the domain's DNS zone
DNS Auto-Validation (Route 53) — Manual	You have Route 53 integration but want to create the record manually
DNS Auto-Validation (Route 53) — Automatic	The CLM creates and manages the DNS records automatically

---

Step 3 — Validate the domain

The process varies depending on the method chosen:

HTTP Challenge

1. Copy the token generated by the CLM
2. Create a file on the server at the indicated path:

   /.well-known/acme-challenge/<token>
3. Paste the generated content as the file's content
4. Confirm that the file is publicly accessible
5. Click Verify & Issue Certificate

DNS Challenge (Manual)

1. Copy the TXT record generated by the CLM
2. Add the record to your domain's DNS zone
3. Wait for DNS propagation (may take a few minutes)
4. Click Verify & Issue Certificate

Route 53 — Manual

1. Select the AWS integration and the corresponding Hosted Zone
2. Copy the generated TXT record
3. Add the record manually in Route 53
4. Click Verify & Issue Certificate

Route 53 — Automatic

No manual action needed. The CLM automatically performs:

1. Creates the TXT record in Route 53
2. Waits for DNS propagation
3. Validates the domain with Let's Encrypt
4. Issues the certificate
5. Removes the created TXT record

Track the progress in real time on the screen.

---

Step 4 — Certificate issued

After validation, the certificate appears under Certificates with status Valid. From there you can download it, set up automatic renewal, or link it to a Store.