lets-encrypt

Manage Let's Encrypt certificate chains, renewal timing, and ACME configurations.

1|Updated Apr 15, 2026
One-click install
npx skills add https://github.com/MysticRyuujin/spirens --skill lets-encrypt
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: lets-encrypt
Source: https://github.com/MysticRyuujin/spirens/tree/main/lets-encrypt
Command: npx skills add https://github.com/MysticRyuujin/spirens --skill lets-encrypt

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill explains and guides on managing Let's Encrypt certificate chains, including intermediates, root trust, and how to time renewals to avoid outages.

Core Features & Use Cases

  • Understand current chain composition (R10/R11 vs E5/E6) and when to switch between RSA and ECDSA key types.
  • Plan renewal windows (notAfter thresholds) and staging environments to safely test changes before production deployment.
  • Distinguish account keys from cert keys, and configure ACME clients accordingly to prevent rate-limit or key-compromise risks.

Quick Start

Configure your ACME client to renew at day 60 for 90-day certs and verify the correct intermediate chain is served.

Frequently Asked Questions about lets-encrypt

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I plan Let's Encrypt renewal timing to avoid TLS outages?

Plan Let's Encrypt renewal timing by configuring your ACME client to renew at day 60 for 90-day certificates. This 60-day renewal threshold provides a safety buffer to prevent validation failures and TLS outages before expiry.

What is the difference between Let's Encrypt account keys and certificate keys?

Let's Encrypt account keys authenticate your ACME client with the CA, while certificate keys secure the TLS connections. Separating them prevents key-compromise risks and avoids rate-limit issues during certificate management.

When should I switch between RSA and ECDSA key types for Let's Encrypt certificates?

Switch between RSA and ECDSA key types based on your chain composition needs, such as R10/R11 versus E5/E6 intermediates. ECDSA offers better performance, while RSA provides broader compatibility for diverse TLS deployments.

Can I use Let's Encrypt staging environments to test ACME configurations before production?

Yes, you can use Let's Encrypt staging environments to safely test ACME configurations and renewal changes. Staging endpoints allow environment-aware testing without hitting production rate limits before deployment.

How do I verify the correct intermediate chain is served for my Let's Encrypt certificate?

Verify the correct intermediate chain by checking your TLS deployment serves the proper Let's Encrypt intermediates. This ensures accurate chain-of-trust validation, preventing browser errors and securing connections for home labs and CI workflows.