Every SSL certificate on the web today is either free and slightly annoying to set up, or paid and easy — that trade has existed since Let's Encrypt launched free certificates in 2016. Nine years later, a huge number of small business sites still run expired or self-signed certificates, not because free certificates don't exist, but because "free" still meant "install an ACME client, configure it, keep it running, and hope the renewal cron job doesn't silently fail." This is about closing that gap without hand-waving the actual security model.
What a domain actually needs, concretely
An SSL/TLS certificate does one specific job: it lets a browser confirm it's actually talking to your domain, not an impostor, and encrypts the connection so nobody between the visitor and your server can read or tamper with the traffic. Without one, browsers show "Not Secure" warnings, and increasingly, some browsers and email clients degrade the experience or block content outright.
Let's Encrypt, a nonprofit certificate authority, issues these for free to anyone who can prove they control a domain. The certificates themselves cost nothing. The friction has always been the proving-control-and-installing part.
How docstoc's SSL automation actually works
To be specific about what's automated and what isn't, since overselling this kind of thing is how people end up with a false sense of security:
1. **Add your domain.** You tell docstoc which domain or subdomain needs a certificate. 2. **Add one DNS TXT record.** docstoc generates a DNS-01 challenge value — a specific string Let's Encrypt needs to see in your domain's DNS to confirm you control it. You paste that one TXT record into whatever DNS provider you already use (Cloudflare, GoDaddy, Namecheap, whichever). This is the one manual step, and it's unavoidable — no service can prove you control a domain without you doing something in that domain's DNS. 3. **docstoc completes the ACME order.** Once the DNS record propagates, docstoc runs the actual ACME protocol exchange against Let's Encrypt's real, production certificate authority — not a staging or test certificate. The certificate you get is issued directly by Let's Encrypt; docstoc automates the protocol handshake, it isn't the certificate authority itself. 4. **You get a real, trusted certificate**, valid for 90 days, which is how long every Let's Encrypt certificate lasts regardless of who issues it.
The part that's genuinely worth being upfront about: renewal
Let's Encrypt certificates expire every 90 days, by design — short lifetimes are intentional, to limit the damage if a certificate or its key is ever compromised. A "fully automated" renewal claim usually means one of two things: either the service has an API integration with your specific DNS provider that can update the TXT record without you touching anything, or it means "we'll remind you and make re-verifying fast."
docstoc's current SSL automation is the second kind: an expiry reminder well before the 90-day certificate lapses, and a fast, one-click re-verification flow once you're notified — not a silent background renewal that touches your DNS provider without you knowing. If your DNS provider changes the TXT record's value or you're on a provider docstoc doesn't have a direct API integration with (most providers, currently), a fully silent renewal isn't something any tool can honestly promise without that per-provider integration existing. Being clear about that distinction now is cheaper than a customer discovering it the hard way during an unexpected expiry.
Why not just use a CDN's built-in SSL instead?
If your site already sits behind Cloudflare, Vercel, or a similar platform, you may already have a form of free SSL with zero setup — that's a legitimate option and often the simplest one for a brand-new site. Where docstoc's approach is useful instead: domains that aren't fronted by one of those platforms, internal tools, subdomains pointed at infrastructure you control directly, or any case where you specifically want a real Let's Encrypt certificate issued to your own domain rather than terminated at a third-party edge network.
A short, honest checklist before you set this up
- Confirm you can actually edit DNS for the domain — if a client or IT department controls DNS and you don't have access, you'll need them for the one manual TXT-record step regardless of which tool you use.
- Know which subdomains you actually need covered — a certificate for `example.com` doesn't automatically cover `app.example.com` unless it's requested as a wildcard or as a separate certificate.
- Put the renewal reminder email somewhere you'll actually see it. A 90-day cycle is long enough that "I'll deal with it later" reliably turns into an expired certificate at an inconvenient moment.
FAQ
Is the certificate actually issued by Let's Encrypt, or by docstoc?
By Let's Encrypt directly. docstoc completes the ACME protocol exchange on your behalf, but the certificate authority is Let's Encrypt's own production directory — the same one any ACME client talks to.
Do I need to install any software or run a CLI tool?
No. The only manual step is pasting one DNS TXT record into your domain's DNS provider; everything else happens inside the docstoc app.
How long does the whole process take?
Once the DNS record is added, it depends on how quickly your DNS provider propagates the change — often minutes, sometimes longer depending on the provider and existing TTL settings.
What happens when the certificate is close to expiring?
docstoc sends a reminder ahead of the 90-day expiry. Renewing requires a quick re-verification, not a full from-scratch setup, but it isn't a fully silent background renewal — see the renewal section above for why.
Is this free?
Yes — Let's Encrypt certificates are free by design, and docstoc doesn't charge separately for the automation on top of it; custom-domain SSL is included on paid plans.
Does this replace my hosting provider's SSL?
Not necessarily — if your host already provides SSL automatically (many do), you may not need this. It's most useful for domains or subdomains that aren't already covered by a platform's built-in certificate handling.