---
title: "How to integrate with a Let's Encrypt CA"
slug: "clm-integrate-letsencrypt-ca"
updated: 2026-11-06T18:30:05Z
published: 2026-11-06T18:30:05Z
canonical: "docs.senhasegura.io/clm-integrate-letsencrypt-ca"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# How to integrate with a Let's Encrypt CA

This document provides information on how to integrate with a Let's Encrypt certificate authority. For more information about the Let's Encrypt certificate authority fields, see [Certificate authorities](/v4-2/docs/certificate-manager-reference-supported-cas#let%E2%80%99s-encrypt).

## Integrate with a Let's Encrypt CA

1. On Segura™, in the navigation bar, hover over the **Products menu** and select **Certificate Manager**.
2. In the side menu, select **Management** > **Authorities** > **Certificate authorities**.
3. In the top right corner, click **Add**, and select **Let's Encrypt**.
4. In the **Name *** field, enter a name to identify the CA.
5. Select the button **Status** to activate or deactivate the CA.
6. In the **Use Network Connector?** field, select **Yes** or **No**. The default is **Yes**.
7. If the value of the **Use Network Connector?** field is **Yes**, in the **Network Connector** field, select the Network Connector to be used. Leave it empty to use the default Network Connector.
8. In the **Emails (comma separated) *** field, enter the email address used to register the Let's Encrypt account.
9. In the **Private key password** field, enter the Let's Encrypt password.
10. If applicable, tick the **Use existing account** checkbox to use an existing account.
11. In the **Private key** field, enter the private key. This field will only be available if the checkbox **Use existing account** is ticked.
12. In the **Public key** field, enter the public key. This field will only be available if the checkbox **Use existing account** is ticked.
13. Click **Save**.

## Network Connector behavior

When **Use Network Connector?** is set to **No**, the CA does not show any Network Connector information when you request a certificate, and it communicates with Let's Encrypt directly.

When **Use Network Connector?** is set to **Yes**, the certificate request shows **Uses Network Connector: `<agent>`** next to **Choose CA**: the name of the connector you selected, or **default connector** if you left the **Network Connector** field empty. The following traffic routes through that connector:

- The communication with the Let's Encrypt API, including certificate revocation.
- For file validation (http-01), the upload of the domain-validation file to the web server over SFTP, FTP, or FTPS.
- For DNS validation (dns-01), the lookup of the DNS TXT record.

Before Let's Encrypt validates the domain, Segura® checks the published validation file over HTTPS directly from the Segura® appliance, without the Network Connector.

If the Network Connector agent is unreachable, the tunnel fails, or no agent and no default connector are available, Segura® never falls back to a direct connection:

- **Signing:** the certificate request stays in **Waiting signature** status with the reason, and Segura® retries it on the next execution.
- **Revocation:** the revocation ends in error.

Through a Network Connector, FTP uploads use the agent's SOCKS5 proxy in passive mode. If the FTP server does not accept passive mode (PASV), the validation fails with a message saying that passive mode is required. FTPS uploads do not verify the FTP server's certificate.

## Rate limits

Let's Encrypt limits issuance to 50 certificates per registered domain every 7 days. When the limit is reached, Segura® processes the request again after the wait time that Let's Encrypt returns.

The **Uses Network Connector: `<agent>`** text and the **Validation type** field both appear on the certificate-request screen. See [How to sign a request](/v4-2/docs/certificates-flow-how-to-sign-request).