How does Let's Encrypt know I own my domain — for free, in seconds?

How does Let's Encrypt know I own my domain — for free, in seconds?

If no human reviews the request, what stops me from getting a certificate for a domain I don't control? The answer is the ACME protocol's challenge mechanism, and understanding it demystifies the whole "free certificate" model.

Let's Encrypt issues only domain-validated certificates, and validation is automated via ACME (Automatic Certificate Management Environment, RFC 8555). To prove control, the CA issues a challenge your client must satisfy:

— HTTP-01: serve a specific token at http://yourdomain/.well-known/acme-challenge/<token>. Only someone controlling the web server on port 80 can do this.
— DNS-01: publish a TXT record at _acme-challenge.yourdomain. Only someone controlling DNS can do this — and it's the only method that can issue wildcards.
— TLS-ALPN-01: respond on port 443 with a special certificate during the handshake.

The CA verifies the challenge from multiple network vantage points (Multi-Perspective Issuance Corroboration, added 2020) to defeat localized BGP hijacks. Because the proof is control of infrastructure, not paperwork, no human and no fee are needed.

What this does not establish is organizational identity — that's the deliberate scope limit of DV certificates.

Further reading: RFC 8555 (ACME); Let's Encrypt's MPIC announcement.

Bottom line: "free" works because validation is automated proof you control the server or DNS — nothing more, nothing less.