Get a free SSL certificate
Verify a domain you manage and request a trusted Let’s Encrypt certificate. Your private key is generated in your browser. Issuance and renewal are free.
- 1Enter domain
- 2Add DNS records
- 3Request certificate
- 4Download and install
No paid plan or credits. A free account, DNS management access, fair-use limits and CA rate limits apply. Each request covers one hostname or one wildcard. Validity follows the certificate actually issued by the CA.
This is the CA staging environment. Test certificates are not trusted by browsers and must not be presented as production trusted certificates.
Loading account and request settings…
Continue with a free account
The public guide is available without signing in. Sign in to save requests, verify your domain and download certificates for free. No paid plan is required.
1. Enter domain
Save your private key before continuing
The private key is held only in this page’s memory. This website cannot recover it. Download it and store it securely; refreshing or leaving may require a new request. Do not share it.
2. Add these TXT records
Add the TXT records listed below. A new account-binding proof is always required. The CA challenge is listed when needed; an existing valid CA authorization may leave only the binding record. Keep other TXT values at the same name.
If a name already has TXT values, keep them and add this value. Some DNS providers append your domain automatically: check the full name before saving. Do not overwrite SPF, DKIM or other requests.
3. Confirm issuance after DNS validation
Issuance is available only after verification. Your request-specific binding proof is checked again with fresh DNS before issuance, even if the CA validated the domain earlier.
4. Certificate issued — install it next
Issuance does not deploy the certificate. Install it and its matching private key on your server, hosting panel or CDN, reload as required, and check the certificate actually served to visitors.
SHA-256 fingerprint
How do I install the downloaded certificate?
- Nginx: store the fullchain PEM and matching private key securely, set ssl_certificate and ssl_certificate_key, test the configuration and reload.
- Hosting panels: choose custom certificate, provide the full certificate chain and matching private key, then save and deploy using the panel’s instructions.
- CDNs and load balancers: use the provider’s custom-certificate settings to upload the full chain and private key. Compatibility and renewal requirements depend on that provider.
- Finally, open the SSL certificate checker or return to the monitor and click its recheck action. Downloading or issuing a certificate does not prove that your live certificate has changed.
Frequently asked questions
Is SSL issuance and renewal really free?
Yes. Issuance, download and renewal through this tool do not require a paid plan or credits. You need a free account and DNS management access. Fair-use limits, CA rate limits and CA issuance rules still apply.
Why are there two DNS TXT records?
_xunl-ssl authorizes the domain for this account and this request. _acme-challenge lets the certificate authority validate domain control. Add each record shown and keep other TXT values at the same name.
Can I get a wildcard certificate? Does it include the root and www?
Each request supports one hostname or one wildcard, such as *.example.com. A wildcard does not include example.com itself or deeper subdomain levels. Request and install certificates for example.com and www.example.com separately.
Where is my private key? Can XunL recover it?
A new private key is generated locally with WebCrypto and held only in page memory for you to download. It is never uploaded or saved to persistent browser storage. Keep the downloaded file safe. A lost key requires a new key and request. The CSR and certificates are public material and do not contain your private key.
Will certificates renew or deploy automatically?
This is a manual DNS workflow. It does not promise unattended renewal or deployment. Renewal is free, but requires a new request and current DNS verification. Install the certificate on your server or CDN, then recheck the live certificate and its actual expiry date.