Let’s Encrypt alternatives: free ACME certificate authorities
Let’s Encrypt isn’t the only free certificate authority. Google Trust Services, ZeroSSL, SSL.com and Actalis all issue free certificates over ACME. Here’s how they differ, how to set each up, and why a backup CA is worth having.
Why look beyond Let’s Encrypt?
Let’s Encrypt is excellent, and for most people it’s the right default. But there are good reasons to set up a second free CA:
- Outages. Any CA can have an incident. A backup keeps renewals going.
- Rate limits. Let’s Encrypt allows 50 certificates per registered domain every 7 days and 300 new orders per account every 3 hours. Large rollouts can hit them. (Renewals using ACME Renewal Information are exempt from all of them.)
- Mass revocation. If a CA has to revoke certificates on short notice, a second CA lets you replace them quickly.
- Policy. Some organizations want a CA from a particular company or country.
Every CA below is free over ACME, issues 90-day DV certificates trusted by browsers, and works with any ACME client.
The free ACME certificate authorities
| CA | Account needed | Wildcards | Names per certificate |
|---|---|---|---|
| Let’s Encrypt | No | Yes | Up to 100 |
| Google Trust Services | Google Cloud project, EAB key | Yes | Many |
| ZeroSSL | ZeroSSL account, EAB key | Yes | Many |
| SSL.com | SSL.com account, EAB key | No | One domain and its www. name |
| Actalis | Actalis account, EAB key | No | One domain and its www. name |
As of October 2026. Buypass ended its free ACME service in October 2025.
What is EAB?
Every CA except Let’s Encrypt uses External Account Binding: you create an account on the CA’s website, it gives you a key ID and an HMAC key, and your ACME client uses them once to link its ACME account to yours. After that, renewals need nothing else.
Google Trust Services
Google’s CA, which also issues certificates for Google’s own services. Free over ACME, wildcards included. To get an EAB key: in a Google Cloud project, enable the Public Certificate Authority API, give yourself the role Public CA External Account Key Creator, then in Cloud Shell run:
gcloud publicca external-account-keys createUse the keyId and b64MacKey it prints straight away: the key works once and expires after 7 days. Treat it like a password and don’t paste it into chats or tickets.
ZeroSSL
Free 90-day certificates over ACME, wildcards included; ZeroSSL also maintains the acme.sh and win-acme clients. Get EAB credentials from ZeroSSL’s Developer page, or, in EverTLS, just enter your ZeroSSL account email and EverTLS fetches them.
SSL.com and Actalis
Both offer free 90-day certificates over ACME for one domain and its www. name, without wildcards. Create an account, then copy the EAB key ID and HMAC key from its console. One catch with SSL.com: if your account has funds, SSL.com issues and charges for a paid one-year certificate instead of the free one.
Using a backup CA with EverTLS
Every plan includes all five CAs. Under Certificate authorities, connect the ones you want, choose your main CA, and set another as the backup. If an order fails at the main CA (an outage, a rate limit), EverTLS issues from the backup automatically and tells you. For the best coverage, pick a backup that issues the same kinds of certificates: Google Trust Services or ZeroSSL for wildcard and multi-name certificates.
EverTLS also works with any other ACME CA, including a private one inside your network, by its directory URL.