MCP server for SSL certificates.

Connect Claude, ChatGPT, Cursor or VS Code to EncryptSSL and manage free Let's Encrypt certificates by asking. Your assistant requests the certificate, tells you exactly which DNS record or file to add, checks it and gets it issued.

Server URL

https://api.encryptssl.com/mcp
Set up your AI appCreate a free account

Works with

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Gemini CLI

Get SSL for shop.example.com. I can edit DNS.

Request a certificate

Add this TXT record at your DNS provider:

_acme-challenge.shop.example.com
TXT "Rk3v8sQ2…Yt9dPq"

Done, it's added.

Check domain validation readiness
Validate and issue certificate

Done. shop.example.com has a Let's Encrypt certificate until 27 January 2027. The private key stays in your EncryptSSL dashboard, never in this chat.

Example: in the Claude iPhone app with EncryptSSL connected, Claude requests a Let's Encrypt certificate, shows the DNS record to add, checks it and issues the certificate.

How it works

Connecting takes about a minute, and you only do it once per app.

  1. 1

    Add the server URL

    Paste https://api.encryptssl.com/mcp into your AI app as a custom connector or MCP server.

  2. 2

    Sign in and choose permissions

    Your app opens EncryptSSL. Sign in, then decide whether it can only view your certificates or also request, renew and cancel them.

  3. 3

    Ask in plain language

    Request, check and renew certificates from the chat. Your assistant calls EncryptSSL and tells you anything you need to do on your DNS or server.

What you can ask

You don't need to know the tool names. Describe what you want and your assistant picks the right action.

“Which of my certificates expire in the next 30 days?”
Lists your certificates with their domains, status and expiry dates.
“Get a wildcard certificate for *.example.com.”
Starts a DNS-validated wildcard order and shows the TXT record to add.
“Is the TXT record for shop.example.com live yet?”
Checks your DNS record or HTTP file before anything is sent to Let’s Encrypt.
“Renew api.example.com.”
Creates the renewal and walks you through validation, or installs it for you if the site is on a connected cPanel server.
“Issue a certificate for blog.example.com and install it on my cPanel server.”
Uses your hosting integration to place the validation file, issue the certificate and install it.
“Cancel the pending order for old.example.com.”
Removes orders that were never issued. Issued certificates can only be deleted from your dashboard.
Let's Encrypt

Certificates come from Let's Encrypt

Every certificate your assistant requests is issued by Let's Encrypt, the nonprofit certificate authority that secures hundreds of millions of websites. They are the same domain-validated certificates you get on our free SSL certificate page.

EncryptSSL handles the ACME protocol, keeps your orders and expiry dates in one place, and emails you before a certificate expires. The MCP server lets your AI assistant do all of that for you.

  • Free: no cost per certificate or per domain
  • Trusted by Chrome, Safari, Firefox, Edge and current versions of every major operating system
  • Single-domain, multi-domain (up to 100 names) and wildcard certificates
  • Domain validation by DNS TXT record or by HTTP file
  • Short-lived certificates (currently 90 days), so your assistant tracks renewals
  • EncryptSSL is not affiliated with Let's Encrypt or ISRG. Let's Encrypt is a trademark of the Internet Security Research Group.

Your private keys stay out of the chat

Your assistant works through EncryptSSL's API with the permissions you grant, and nothing more.

Private keys never reach the chat

Your assistant can read certificate details and public certificates. Private keys stay on EncryptSSL; you download them from your dashboard.

You approve every app

Each app has to be approved on an EncryptSSL consent screen, where you choose whether it can only view certificates or also manage them.

Hosting credentials stay hidden

Apps can use your connected cPanel integration to install certificates, but they never see its username, server address or API key.

Disconnect at any time

Remove an app from your dashboard and it loses access immediately. Access tokens expire after an hour and are tied to your account.

Set up EncryptSSL in your AI app

Pick your app for exact steps. You'll need a free EncryptSSL account to sign in.

Server URL

https://api.encryptssl.com/mcp

Connect Claude to EncryptSSL

  1. 1
    In Claude on the web or desktop, open Settings → Connectors and select Add custom connector.
  2. 2
    Name it EncryptSSL and paste the server URL.
  3. 3
    Select Connect, sign in to EncryptSSL and approve access.

Connect ChatGPT to EncryptSSL

  1. 1
    Open Settings → Apps & Connectors → Advanced settings and turn on Developer mode.
  2. 2
    Select Create, name it EncryptSSL, paste the server URL and choose OAuth.
  3. 3
    Sign in to EncryptSSL and approve access, then turn EncryptSSL on from the + menu in a chat.

Developer mode availability depends on your ChatGPT plan.

Connect Claude Code to EncryptSSL

  1. 1
    Add the server from your terminal:
    Terminal
    claude mcp add --transport http encryptssl https://api.encryptssl.com/mcp
  2. 2
    Start Claude Code, run /mcp, choose encryptssl and sign in.

Connect Cursor to EncryptSSL

  1. 1
    Add EncryptSSL to ~/.cursor/mcp.json, or to .cursor/mcp.json in a project:
    mcp.json
    {
  "mcpServers": {
    "encryptssl": {
      "url": "https://api.encryptssl.com/mcp"
    }
  }
}
  2. 2
    Cursor opens EncryptSSL in your browser. Sign in and approve access.

Connect VS Code to EncryptSSL

  1. 1
    Run MCP: Add Server from the Command Palette, choose HTTP and paste the server URL. Or add it to .vscode/mcp.json:
    .vscode/mcp.json
    {
  "servers": {
    "encryptssl": {
      "type": "http",
      "url": "https://api.encryptssl.com/mcp"
    }
  }
}
  2. 2
    Start the server when VS Code asks, then sign in to EncryptSSL and approve access.

Connect Other to EncryptSSL

  1. 1
    Any MCP client that supports remote servers with OAuth sign-in works, including Windsurf and Gemini CLI.
  2. 2
    Add a remote (Streamable HTTP) MCP server with the server URL. Your client opens EncryptSSL to sign in.

Questions about the MCP server

What is an MCP server for SSL certificates?

MCP (Model Context Protocol) is an open standard that lets AI apps use outside tools. The EncryptSSL MCP server gives your AI assistant tools to request, validate, renew and track SSL certificates in your EncryptSSL account, so you can manage certificates by asking instead of clicking through a dashboard.

Which AI apps work with the EncryptSSL MCP server?

Claude (on the web, desktop and Claude Code), ChatGPT with developer mode, Cursor, VS Code, Windsurf, Gemini CLI and any other MCP client that supports remote servers with OAuth sign-in.

Is it free?

Yes. EncryptSSL accounts, Let’s Encrypt certificates and the MCP server are all free. Some AI apps only allow custom connectors on certain plans, so check your app’s plan if you can’t find the option.

Can the AI see my private key?

No. Private keys are never sent to AI apps. Your assistant can see certificate details, expiry dates and the public certificate, and it tells you to download the private key from your EncryptSSL dashboard.

How does domain validation work in a chat?

Let’s Encrypt has to confirm you control each domain. Your assistant shows you the exact DNS TXT record or HTTP file to add, checks that it is live, then asks Let’s Encrypt to validate the domain and issue the certificate. If the site is on a connected cPanel server, it can do all of this for you.

Can I get a wildcard certificate this way?

Yes. Ask for a certificate for a name like *.example.com and your assistant starts a DNS-validated wildcard order. A wildcard certificate can’t include other domain names in the same order.

Can my assistant renew certificates?

Yes. Ask it to renew any issued, expiring or expired certificate. If the original was installed through your cPanel integration, the renewal is installed the same way. EncryptSSL also emails you before a certificate expires.

How do I remove an AI app’s access?

Open AI Apps in your EncryptSSL dashboard and disconnect the app. It loses access immediately. You can also disconnect every app at once.

Is EncryptSSL part of Let’s Encrypt?

No. EncryptSSL is an independent service that requests certificates from Let’s Encrypt’s public ACME API. Let’s Encrypt is a trademark of the Internet Security Research Group (ISRG).

Connect your AI app to EncryptSSL

A free account is all you need. Paste the server URL into your app and sign in.

https://api.encryptssl.com/mcp
Create a free accountSee setup steps