The browser generates separate ACME account and certificate keys. Only signatures and the CSR are sent to Let's Encrypt.
Free TLS/SSL certificate
Let's Encrypt Certificate Generator
Verify your domain and download a trusted certificate plus its private key. No account or server upload is required.
1Certificate details
2Verify domain
3Download files
Step 1
Choose the certificate
Wildcard certificates require DNS validation. The root domain is included automatically.
Testing option
Step 2
Add the validation record
Request:
The root and wildcard names use the same TXT record name. Add both TXT values at the same time; do not replace one with the other.
Before continuing
- DNS validation: wait until every TXT value is publicly visible. DNS changes can take several minutes.
- HTTP validation: open the exact challenge URL in a private window and confirm it shows only the supplied content.
- Keep this page open. The private key exists only in this tab.
Step 3
Download your certificate
Save the private key now. It cannot be recovered after this page is closed.
Important: FileTiny does not retain your private key or certificate. Back them up securely before leaving.
How certificate issuance works
Add a DNS TXT record or publish a small HTTP challenge file. Wildcard certificates always use DNS.
After validation, Let's Encrypt returns the certificate chain. Download it with the matching private key.
TLS/SSL certificate guide
How do I request a Let's Encrypt certificate?
Choose a single-domain or wildcard certificate, enter the domain, and generate validation details. Single domains can use DNS TXT or HTTP file validation. Wildcard certificates require DNS validation. After validation, download the certificate and its matching private key.
Should I use DNS or HTTP validation?
- DNS validation works for root, subdomain, and wildcard names and requires access to DNS records.
- HTTP validation works for single domains and requires publishing a file under
/.well-known/acme-challenge/. - A wildcard plus root-domain order may require two TXT values under the same record name at the same time.
Which certificate files should I download?
Most Nginx, Caddy, and reverse-proxy configurations use fullchain.pem with private.key. The ZIP also contains the leaf certificate and intermediate chain for other server panels.
What happens when the certificate expires?
This tool does not retain keys or renew certificates in the background. Request another certificate before expiry, or use a server ACME client such as Certbot or acme.sh for unattended renewal.
Related searches:Let's Encrypt certificate generatorfree SSL certificatewildcard certificatedownload TLS certificate
FAQ
Let's Encrypt certificate questions
Does FileTiny save the certificate private key?
No. The private key is generated and used only in the memory of this browser tab. It is not sent to FileTiny or written to localStorage. Download and back it up before closing or resetting the page.
Why do wildcard certificates require DNS validation?
Let's Encrypt requires DNS-01 validation for wildcard names. Add every generated TXT value to DNS and keep simultaneous values in place until issuance finishes.
Does this tool renew certificates automatically?
No. This page is for requesting and downloading a certificate. For unattended renewal, run an ACME client such as Certbot or acme.sh on your server.