The End of an Era: LettuceEncrypt Archived

For developers running ASP.NET Core applications directly on Kestrel, managing TLS certificates has always been a less-than-elegant process. For years, the go-to solution was LettuceEncrypt, a library that handled the acquisition and renewal of Let's Encrypt certificates directly within the application. However, this project was archived in April 2025, with its final release supporting only .NET 6. This leaves a significant gap for those who do not front their Kestrel instances with a reverse proxy like Nginx or a cloud load balancer.

The archiving of LettuceEncrypt, coupled with evolving Let's Encrypt policies, necessitates a re-evaluation of how to achieve automatic HTTPS for self-hosted Kestrel applications. The landscape has shifted, and the old methods are no longer viable. This leaves developers asking: how do we secure our Kestrel deployments moving forward?

Shrinking Certificate Lifespans Demand Frequent Automation

A critical change impacting certificate management is the reduction in Let's Encrypt's certificate validity periods. The Certificate Authority has transitioned to issuing certificates with a maximum lifespan of six months, and in some cases, the default lifetime is being further reduced to just 45 days. While the security benefits are clear – a compromised key is useful for a shorter duration – the practical implications for automated renewal are profound. Manual renewal, or even scheduled renewals via cron jobs with infrequent intervals, will become insufficient. A certificate rotated manually or on a fixed, infrequent schedule will inevitably expire. Automation is no longer optional; it must be frequent, robust, and seamless.

Predictable Renewal Timing is Key

Historically, renewal timing might have involved some educated guesswork or reliance on the default 90-day renewal window. However, with the new, shorter lifespans, this approach becomes untenable. Automated systems need to be precisely timed to ensure continuous coverage without falling into the trap of attempting renewals too early or too late. The exact timing of renewal attempts becomes crucial. Let's Encrypt's ACME protocol has specific requirements for renewal, typically allowing renewals when a certificate has 30 days or less remaining. With a 45-day certificate, this window is significantly tighter. Systems must be designed to accommodate this accelerated cycle.

The Need for Modern ACME Clients

LettuceEncrypt abstracted away the complexities of the ACME (Automated Certificate Management Environment) protocol. With its retirement, developers must turn to alternative ACME clients that can be integrated into their .NET applications or managed externally. Several options exist, each with its own integration strategy:

  • Certes: This is a .NET ACMEv2 client library that aims to provide a robust and flexible solution. It can be embedded directly into an ASP.NET Core application, allowing for in-process certificate management. Certes supports various challenge types (HTTP-01, DNS-01) and can be configured to handle renewals automatically. Its design philosophy emphasizes flexibility, allowing developers to tailor the renewal process to their specific needs.
  • ACMESharp: Another .NET-based ACME client, ACMESharp offers similar capabilities for obtaining and renewing certificates. It also supports different challenge types and provides mechanisms for automated renewal. Developers can integrate this library into their applications to manage certificates programmatically.
  • External ACME Clients: For those who prefer to keep certificate management separate from the application logic, external tools can be employed. Clients like Certbot (primarily Linux-focused) or win-acme (for Windows) can be installed on the server hosting the Kestrel application. These tools typically run as background services or scheduled tasks, obtaining certificates and placing them in a location accessible by Kestrel. This approach decouples certificate management from the application lifecycle but requires careful configuration to ensure Kestrel can access and use the obtained certificates.

Integrating with Kestrel

Regardless of the chosen ACME client, integration with Kestrel requires configuring the application to use the obtained certificates for HTTPS. This typically involves:

  • Loading the Certificate: The certificate (and its private key) must be loaded by the Kestrel server. This can be done via file paths or by loading from a certificate store.
  • Configuring HTTPS Listener: The Kestrel server's configuration needs to specify the IP address and port for the HTTPS listener, along with the loaded certificate.
  • Automated Renewal Triggering: The chosen ACME client must be configured to trigger renewals automatically. For in-process clients like Certes or ACMESharp, this might involve background tasks within the application. For external clients, it means ensuring their scheduled tasks are correctly set up.
  • Certificate Reloading: Crucially, the application must be able to reload the certificate after it has been renewed without restarting the entire application. Many Kestrel configurations allow for dynamic certificate updates, which is essential given the frequent renewal cycles.

What Happens to Existing Deployments?

For applications still relying on LettuceEncrypt and targeting older .NET versions (like .NET 6), a migration strategy is imperative. Developers must plan to upgrade their applications to a supported .NET version and integrate a new ACME client. This transition requires careful testing to ensure uninterrupted service. The move from LettuceEncrypt to a new solution is not merely a library swap; it’s an architectural consideration for securing self-hosted Kestrel applications.

The Future of Automated HTTPS on Kestrel

The archiving of LettuceEncrypt and the tightening of Let's Encrypt's policies mark a significant shift. Developers can no longer rely on a single, embedded solution that maintained itself with minimal intervention. The future points towards more explicit integration of ACME clients, whether embedded within the application or managed externally. The emphasis is on robust automation, precise timing, and the ability for the application to dynamically reload certificates. For teams running Kestrel without a front-end proxy, understanding and implementing these new patterns is critical to maintaining secure, always-on services in 2026 and beyond.