How to Add Free HTTPS to Your Self-Hosted Apps with Let's Encrypt

Self-hosting a dashboard or media server over plain HTTP works until a browser flags it as insecure and your password travels in the clear. Free HTTPS with Let's Encrypt fixes that for nothing, issuing trusted TLS certificates that a reverse proxy requests and renews on your behalf, so the padlock appears and stays there without you ever touching a renewal command.

Quick Answer

Let's Encrypt issues free TLS certificates valid for 90 days, and a reverse proxy like Traefik or Nginx Proxy Manager handles the entire request-and-renewal cycle automatically. Set it up once, and your self-hosted apps keep a valid certificate forever at zero cost and with zero manual renewal.

How Let's Encrypt works

Let's Encrypt is a free certificate authority that issues certificates over the ACME protocol. Instead of paying for an SSL certificate and renewing it by hand each year, you point an ACME client at a domain you control, it proves ownership through an automated challenge, and a trusted certificate is issued in seconds. The catch that scares newcomers is the 90-day validity, but that short life is the point: it is designed to be renewed by software, not a person, and automatic renewal means a certificate never actually expires under you.

There are two common ways to prove you own the domain. The HTTP-01 challenge has the CA fetch a token from your server over port 80. The DNS-01 challenge has you publish a token as a DNS record, which works even when nothing is exposed to the public internet, making it the better fit for internal home-lab apps.

Option one: Nginx Proxy Manager

Nginx Proxy Manager is the gentlest way in because it gives you a web interface. You run it as a container, log into its dashboard, and add a proxy host pointing at the internal app you want to secure. On the SSL tab you request a Let's Encrypt certificate, agree to the terms, and it provisions the certificate for you. From then on the built-in Let's Encrypt support renews the certificate automatically before it lapses. For anyone who would rather click than edit config files, this is the route to take.

Option two: Traefik

Traefik suits a container-heavy setup where you want certificates handled as part of your infrastructure rather than through a separate UI. It speaks ACME natively. You define a certificate resolver once in the Traefik configuration, choosing the HTTP-01 or DNS-01 challenge, and then any HTTPS router you create automatically requests its certificate from Let's Encrypt and renews it when due. Add a new service, label it, and Traefik secures it without further steps. You do need to invest time up front learning its declarative config style, but the payoff is fully automated, hands-off certificate management across everything you host.

Picking your approach

If you want the simplest possible path and a friendly interface, start with Nginx Proxy Manager. If you already run Docker for everything and want certificates baked into your stack, Traefik is the cleaner long-term answer. Both deliver the same result: free, trusted, auto-renewing HTTPS. Either runs comfortably on a small always-on box -- a quiet, efficient machine that draws little power and stays up around the clock is all you need. The mini PCs at Evetech are a natural fit for this kind of always-on home server role. For a broader look at what SA builders are running, browse the top-selling PCs at Evetech for current popular configurations.

Wildcard certificates and the DNS-01 challenge

If you want a single certificate that covers every subdomain under a domain -- say *.yourdomain.com -- you need a wildcard certificate, and the only way to get one from Let's Encrypt is through the DNS-01 challenge. Unlike HTTP-01, which proves domain ownership by serving a token over port 80, DNS-01 proves it by publishing a temporary TXT record in your DNS. This means your ACME client needs API access to your DNS provider to create and delete those records automatically during both initial issuance and renewal.

For a home lab, this is very useful for internal apps that are never directly exposed to the internet. The HTTP-01 challenge requires that your server answer on a public port; the DNS-01 challenge has no such requirement, so it works cleanly for services you access only over a VPN or local network. If your domain registrar or DNS provider offers an API that Traefik or Certbot supports, DNS-01 is worth setting up from the start.

Rate limits and the staging environment

Let's Encrypt imposes rate limits: up to 50 certificates per registered domain per week and 300 new orders per account every three hours. For a home lab with a handful of subdomains, these limits are generous. Where they bite is during troubleshooting, if you repeatedly request certificates while debugging a misconfiguration.

The fix is to point your ACME client at the Let's Encrypt staging environment during setup. Staging has far higher limits and issues test certificates that are not publicly trusted, so they are not useful in a browser but confirm that your setup is correct before you switch to production. Most tools support this with a single flag or config option. Test on staging until the certificate appears cleanly, then switch to production and issue the real thing.

One other note for 2026: Let's Encrypt is progressively reducing the default certificate lifetime from 90 days toward 45 days to tighten the renewal cycle further. This is intentional and safe provided your renewal automation is reliable. If you set it up properly through Nginx Proxy Manager or Traefik, shorter lifetimes cost you nothing, since renewals are automatic.

Frequently Asked Questions

How long do Let's Encrypt certificates last?

Each certificate is valid for 90 days. The short life is intentional and is meant to be handled by automatic renewal, so in practice your certificates never expire.

Does it really cost nothing?

Yes. Let's Encrypt is a free, non-profit certificate authority. The certificates and the renewals are at no cost, and the tools that automate them are open source.

What if my server is not exposed to the internet?

Use the DNS-01 challenge. It proves domain ownership by publishing a DNS record rather than answering over a public port, so it works for internal apps that are never reachable from outside.

Do I have to renew the certificate myself?

No. Traefik, Nginx Proxy Manager and Certbot all renew automatically well before expiry. Once configured, the renewal runs on a schedule with no input from you.

Which tool should a beginner choose?

Nginx Proxy Manager, because its web interface walks you through requesting and managing certificates without editing configuration files. Traefik is the stronger choice once you are comfortable with containers.