letsencrypt.org Open in urlscan Pro
2a03:b0c0:3:d0::d24:2001  Public Scan

Form analysis
0 forms found in the DOM

Text Content

Skip navigation links
 * Documentation
 * Get Help
 * Donate
   * Make a Donation
   * Become a Sponsor
   * Current Sponsors and Funders
   * Get Involved
 * About Us
   * Let's Encrypt
   * Internet Security Research Group (ISRG)
   * DST Root CA X3 Expiration (September 2021)
   * Frequently Asked Questions (FAQ)
   * Policy and Legal Repository
   * Service Status
   * Statistics
   * Careers
   * Contact
   * Blog
 * Languages
   * ✓ English
   * Deutsch
   * Español
   * Français
   * עברית
   * Bahasa Indonesia
   * Italiano
   * 日本語
   * 한국어
   * Português do Brasil
   * Русский
   * Srpski
   * Svenska
   * Українська
   * Tiếng Việt
   * 简体中文
   * 繁體中文




LENCR.ORG

לעבור לעברית

Переглянути українською

使用简体中文阅读本网页。

Last updated: Nov 30, 2021 | See all Documentation


WHAT’S LENCR.ORG?

lencr.org is a domain name owned by Let’s Encrypt. We use it to host data that
is referenced inside the certificates we issue.


WHY IS MY COMPUTER FETCHING THIS DATA? IS IT MALICIOUS?

No, the data on lencr.org is never malicious. When a device connects to
lencr.org, it’s because client software on that device (like a web browser or an
app) connected to another site, saw a Let’s Encrypt certificate, and is trying
to verify that it’s valid. This is routine for many clients.

We can’t speak to whether the other site being connected to is malicious. If
you’re investigating network activity that seems unusual, then you may want to
focus on the connection that started just before the connection to lencr.org.

The pattern of clients' connections to lencr.org might look unusual or
intermittent. Clients might never retrieve this data; only retrieve subsets of
it; or “cache” some data for efficiency, so they’ll only access it sometimes
(the first time they need it, and when the data may have expired).


WHAT EXACTLY IS THIS DATA FOR?

When client software (like a web browser or an app) connects to a site, and that
site presents a certificate, the client should verify that the certificate is
authentic and valid. This data helps clients do that in several ways.

 * Under o.lencr.org, we provide Online Certificate Status Protocol (OCSP) data.
   A client may use this data to confirm whether an individual unexpired
   certificate that we issued is still valid, or was revoked. (This is only for
   “end-entity” or “leaf” certificates, which we’ve issued to subscribers from
   one of our intermediate certificates.)

 * Under c.lencr.org, we provide Certificate Revocation Lists (CRLs) listing all
   the unexpired certificates that we issued and later revoked. (This is only
   for our intermediate certificates, which we’ve issued from one of our root
   certificates; not for certificates that we’ve issued to subscribers.) A
   client may use this data to verify that our intermediate certificate, which
   issued the end-entity certificate it’s verifying, has not been revoked.

 * Under i.lencr.org, we provide copies of our intermediate “issuer”
   certificates, which are either signed by one of our root certificates or
   “cross-signed” by another Certificate Authority (CA). A client may use this
   data to confirm the “chain of trust” from the end-entity certificate it’s
   verifying, via one or more intermediate steps, to a root CA certificate that
   it recognizes and trusts.


WHY ARE CONNECTIONS TO O.LENCR.ORG OVER INSECURE HTTP?

OCSP responses are always served over HTTP. If they were served over HTTPS,
there would be an “infinite loop” problem: in order to verify the OCSP server’s
certificate, the client would have to use OCSP.

The OCSP response itself is timestamped and cryptographically signed, so the
anti-tampering properties of TLS aren’t needed in this case.


WHY “LENCR.ORG”?

We used to use longer URLs like http://ocsp.int-x3.letsencrypt.org/. However,
when we issued our new root and intermediate certificates, we wanted to make
them as small as possible. Every HTTPS connection on the web (billions per day)
has to send a copy of a certificate, so every byte matters. We chose lencr.org
because of its similarity with our name: Let’s ENCRypt. We pronounce it much
like the fictional region of Lancre in Terry Pratchett’s Discworld novels.

 * GitHub
 * Twitter

View our privacy policy.
View our trademark policy.

Let's Encrypt is a free, automated, and open certificate authority brought to
you by the nonprofit Internet Security Research Group (ISRG).

548 Market St, PMB 77519, San Francisco, CA 94104-5401, USA

Send all mail or inquiries to:

PO Box 18666, Minneapolis, MN 55418-0666, USA


Linux Foundation is a registered trademark of The Linux Foundation. Linux is a
registered trademark of Linus Torvalds.