letsencrypt · bdaehlie · Sep 4, 2026 · Sep 4, 2026
diff --git a/content/en/docs/glossary.md b/content/en/docs/glossary.md
@@ -113,7 +113,7 @@ Note for translators:
 
 {{% def id="OCSP-stapling" name="OCSP stapling" %}} A way for a [web server](#def-web-server) to send a [browser](#def-web-browser) an [OCSP](#def-OCSP) response signed by the [Certificate Authority](#def-CA), so the browser itself doesn’t need to make a secondary OCSP request to the CA, improving speed and privacy. Also known as TLS Certificate Status Request extension. Note that [Let's Encrypt](#def-LE) does not support OCSP. [Wikipedia](https://en.wikipedia.org/wiki/OCSP_stapling) [Cloudflare](https://blog.cloudflare.com/high-reliability-ocsp-stapling/) {{% /def %}}
 
-{{% def id="OID" name="Object identifier" abbr="OID" %}} OIDs are unique numeric identifiers standardized by the International Telecommunications Union (ITU) and ISO/IEC. OIDs are used within certificates to define extensions, fields, or policy assertions. Internet standards and [Certificate Policy](#def-CP) and [Certification Practice Statement](#def-CPS) documents define OID usage. [Wikipedia](https://en.wikipedia.org/wiki/Object_identifier) {{% /def %}}
+{{% def id="OID" name="Object identifier" abbr="OID" %}} OIDs are unique numeric identifiers standardized by the International Telecommunication Union (ITU) and ISO/IEC. OIDs are used within certificates to define extensions, fields, or policy assertions. Internet standards and [Certificate Policy](#def-CP) and [Certification Practice Statement](#def-CPS) documents define OID usage. [Wikipedia](https://en.wikipedia.org/wiki/Object_identifier) {{% /def %}}
 
 {{% def id="OV" name="Organization Validation" abbr="OV" %}} Certificates for which the [CA](#def-CA) has verified the legal entity of the [Subscriber](#def-subscriber). They contain information about that entity. [Let's Encrypt](#def-LE) doesn't offer OV certificates. [Wikipedia](https://en.wikipedia.org/wiki/Public_key_certificate#Organization_validation) {{% /def %}}
 
@@ -155,7 +155,7 @@ Note for translators:
 
 {{% def id="TLD" name="Top-Level Domain" abbr="TLD" %}} Highest level in the hierarchical Domain Name System, such as country-code top-level domains (ccTLDs) like `.de` (Germany), `.cn` (China) and generic top-level domains (gTLDs) like `.com`, `.org`. [Wikipedia](https://en.wikipedia.org/wiki/Top-level_domain) {{% /def %}}
 
-{{% def id="TLS" name="Transport-Layer Security" abbr="TLS" abbr_first="1" %}} The protocol used by HTTPS to encrypt and authenticate web page visits. {{% /def %}}
+{{% def id="TLS" name="Transport Layer Security" abbr="TLS" abbr_first="1" %}} The protocol used by HTTPS to encrypt and authenticate web page visits. {{% /def %}}
 
 {{% def id="TLSA" abbr="TLSA" %}} The part of [DANE](#def-DANE) specifically related to validating [TLS](#def-TLS) connections. {{% /def %}}
 

diff --git a/content/en/post/2015-10-29-phishing-and-malware.markdown b/content/en/post/2015-10-29-phishing-and-malware.markdown
@@ -17,11 +17,11 @@ Let’s Encrypt is going to be issuing Domain Validation (DV) certificates. On a
 
 Treating a DV certificate as a kind of “seal of approval” for a site’s content is problematic for several reasons.
 
-First, CAs are not well positioned to operate anti-phishing and anti-malware operations -- or to police content more generally. They simply do not have sufficient ongoing visibility into sites’ content. The best CAs can do is check with organizations that have much greater content awareness, such as Microsoft and Google. Google and Microsoft consume vast quantities of data about the Web from massive crawling and reporting infrastructures. This data allows them to use complex machine learning algorithms (developed and operated by dozens of staff) to identify malicious sites and content.
+First, CAs are not well positioned to operate anti-phishing and anti-malware operations -- or to police content more generally. They simply do not have sufficient ongoing visibility into sites’ content. The best CAs can do is check with organizations that have much greater content awareness, such as Microsoft and Google. Google and Microsoft consume vast quantities of data about the Web from massive crawling and reporting infrastructures. This data allows them to use complex machine learning algorithms (developed and operated by dozens of staff) to identify malicious sites and content.
 
 Even if a CA checks for phishing and malware status with a good API, the CA’s ability to accurately express information regarding phishing and malware is extremely limited. Site content can change much faster than certificate issuance and revocation cycles, phishing and malware status can be page-specific, and certificates and their related browser UIs contain little, if any, information about phishing or malware status. When a CA doesn’t issue a certificate for a site with phishing or malware content, users simply don’t see a lock icon. Users are much better informed and protected when browsers include anti-phishing and anti-malware features, which typically do not suffer from any of these limitations. 
 
-Another issue with treating DV certificates as a “seal of approval” for site content is that there is no standard for CA anti-phishing and anti-malware measures beyond a simple blacklist of high-value domains, so enforcement is inconsistent across the thousands of CAs trusted by major browsers. Even if one CA takes extraordinary measures to weed out bad sites, attackers can simply shop around to different CAs. The bad guys will almost always be able to get a certificate and hold onto it long enough to exploit people. It doesn’t matter how sophisticated the best CA anti-phishing and anti-malware programs are, it only matters how good the worst are. It’s a “find the weakest link” scenario, and weak links aren’t hard to find.
+Another issue with treating DV certificates as a “seal of approval” for site content is that there is no standard for CA anti-phishing and anti-malware measures beyond a simple blacklist of high-value domains, so enforcement is inconsistent across the thousands of CAs trusted by major browsers. Even if one CA takes extraordinary measures to weed out bad sites, attackers can simply shop around to different CAs. The bad guys will almost always be able to get a certificate and hold onto it long enough to exploit people. It doesn’t matter how sophisticated the best CA anti-phishing and anti-malware programs are, it only matters how good the worst are. It’s a “find the weakest link” scenario, and weak links aren’t hard to find.
 
 Browser makers have realized all of this. That’s why they are pushing phishing and malware protection features, and evolving their UIs to more accurately reflect the assertions that certificates actually make.
 

diff --git a/content/en/post/2025-12-09-10-years.md b/content/en/post/2025-12-09-10-years.md
@@ -41,7 +41,7 @@ As I personally think back on the past decade, just a few of the many events tha
 
 - [Our one millionth certificate](https://letsencrypt.org/2016/03/08/our-millionth-cert) in March 2016, then [our 100 millionth certificate](https://letsencrypt.org/2017/06/28/hundred-million-certs) in June 2017, and then [our billionth certificate](https://letsencrypt.org/2020/02/27/one-billion-certs) in 2020
 
-- Along the way, first issuing one million certificates in a single day (in September 2018), significantly contributed to by the SquareSpace and [Shopify](https://letsencrypt.org/2021/09/14/speed-at-scale-shopify) Let's Encrypt integrations
+- Along the way, first issuing one million certificates in a single day (in September 2018), significantly contributed to by the Squarespace and [Shopify](https://letsencrypt.org/2021/09/14/speed-at-scale-shopify) Let's Encrypt integrations
 
 - Just at the end of September 2025, we issued more than ten million certificates in a day for the first time.
 

diff --git a/content/en/privacy.md b/content/en/privacy.md
@@ -24,7 +24,7 @@ If you are a Subscriber, you are requesting a trusted certificate from Let’s E
 
 We need to be able to demonstrate to the public, including those who rely on the trustworthiness of our certificates, that our services perform as expected. As a result, we may be unable to delete information, including IP addresses. This information may be made public in a number of ways, including via public API, public repositories such as Certificate Transparency (CT) logs, and/or public discussions.
 
-You may have the option to provide contact information, such as your email address, for account service and recovery purposes. Your contact information will not be made public, and it will only be shared per “Law Enforcement and Extenuating Circumstances,” below. By providing your email address, you are consenting to receive service-related emails from us. You may unsubscribe from service-related emails at any time by clicking the “unsubscribe” link at the bottom of our emails or by contacting us at privacy@abetterinternet.org. We will not use your contact information for marketing or promotional purposes without your consent.
+You may have the option to provide contact information, such as your email address, for account service and recovery purposes. Your contact information will not be made public, and it will only be shared per “Law Enforcement Requests and Extenuating Circumstances,” below. By providing your email address, you are consenting to receive service-related emails from us. You may unsubscribe from service-related emails at any time by clicking the “unsubscribe” link at the bottom of our emails or by contacting us at privacy@abetterinternet.org. We will not use your contact information for marketing or promotional purposes without your consent.
 
 You may need to download client software from a repository such as those run by Debian, Ubuntu, Red Hat, or GitHub. Your interaction with such a software repository is governed by that repository's own privacy policy and/or Terms of Use.
 

diff --git a/content/en/upcoming-features.md b/content/en/upcoming-features.md
@@ -54,4 +54,4 @@ Clients may [request a "shortlived" certificate](https://letsencrypt.org/2025/02
 
 ## IP Address Certificates
 
-Shortlived certificates (see above) can request that the certificate [contain IP Addresses](https://letsencrypt.org/2025/02/20/first-short-lived-cert-issued/) in its Subject Alternative Names. These addresses will be [validated in much the same way as DNS Names](https://www.rfc-editor.org/rfc/rfc8738.html) are today.
+Shortlived certificates (see above) can request that the certificate [contain IP Addresses](https://letsencrypt.org/2025/02/20/first-short-lived-cert-issued/) in its Subject Alternative Names. These addresses are [validated in much the same way as DNS Names](https://www.rfc-editor.org/rfc/rfc8738.html) are today.
diff --git a/data/clients.json b/data/clients.json
@@ -86,11 +86,11 @@
 			"url": "https://www.froxlor.org/"
 		},
 		{
-			"name": "Gitlab",
+			"name": "GitLab",
 			"url": "https://about.gitlab.com"
 		},
 		{
-			"name": "HAproxy",
+			"name": "HAProxy",
 			"url": "https://docs.haproxy.org/3.2/configuration.html#12.8"
 		},
 		{
@@ -174,7 +174,7 @@
 			"name": "acme.sh",
 			"url": "https://github.com/Neilpang/acme.sh",
 			"category": "Bash",
-			"comments": "(Compatible to bash, dash and sh)",
+			"comments": "(Compatible with bash, dash and sh)",
 			"challenges": {
 				"TLS-ALPN-01": "true"
 			},
@@ -184,7 +184,7 @@
 			"name": "dehydrated",
 			"url": "https://github.com/lukas2511/dehydrated",
 			"category": "Bash",
-			"comments": "(Compatible to bash and zsh)",
+			"comments": "(Compatible with bash and zsh)",
 			"challenges": {
 				"TLS-ALPN-01": "true"
 			},
@@ -571,7 +571,7 @@
 			"name": "App Service Acmebot",
 			"url": "https://github.com/shibayan/appservice-acmebot",
 			"category": "Microsoft Azure",
-			"comments": "(Compatible to Azure Web Apps / Functions / Web App for Containers)",
+			"comments": "(Compatible with Azure Web Apps / Functions / Web App for Containers)",
 			"last_commit": 1756155435
 		},
 		{
@@ -688,7 +688,7 @@
 			"challenges": {
 				"DNS-01": "true"
 			},
-			"comments": "acmetk is an ACMEv2 proxy to centralize certificate requests and challenges within an organisation and direct them using a single account to Let's Encrypt or other ACMEv2 capable CA's.",
+			"comments": "acmetk is an ACMEv2 proxy to centralize certificate requests and challenges within an organisation and direct them using a single account to Let's Encrypt or other ACMEv2 capable CAs.",
 			"last_commit": 1750083158
 		},
 		{

diff --git a/i18n/en.toml b/i18n/en.toml
@@ -572,7 +572,7 @@ other = "Many organizations match donations to nonprofits made by employees. Che
 other = "Become a sponsor"
 
 [donate_2026_become_a_sponsor_text]
-other = "Nearly 100 companies and organizations support our work – from two-person businesses to nonprofits to Fortune 100 companies. Join our roster of generous sponsors that are helping to provide a more secure and privacy respecting Internet for billions of people."
+other = "Nearly 100 companies and organizations support our work – from two-person businesses to nonprofits to Fortune 100 companies. Join our roster of generous sponsors that are helping to provide a more secure and privacy-respecting Internet for billions of people."
 
 [donate_2026_become_a_sponsor_link_text]
 other = "here"

diff --git a/themes/le-2025/layouts/partials/donorbox.html b/themes/le-2025/layouts/partials/donorbox.html
@@ -21,7 +21,7 @@
 
 <div class="text-center mb-4 donorbox-container">
   <script src="https://donorbox.org/widget.js" paypalExpress="true"></script>
-  <iframe src="https://donorbox.org/embed/support-lets-encrypt?hide_donation_meter=true&language={{ $scratch.Get "lang" }}" name="donorbox" id="dbox-form-embed"  name="donorbox" allowpaymentrequest="allowpaymentrequest" seamless="seamless" frameborder="0" scrolling="no" height="685px" width="100%" class="max-w-[500px] min-w-[250px] max-h-none!"></iframe>
+  <iframe src="https://donorbox.org/embed/support-lets-encrypt?hide_donation_meter=true&language={{ $scratch.Get "lang" }}" name="donorbox" id="dbox-form-embed" allowpaymentrequest="allowpaymentrequest" seamless="seamless" frameborder="0" scrolling="no" height="685px" width="100%" class="max-w-[500px] min-w-[250px] max-h-none!"></iframe>
   <div id="donorbox-fallback" class="mt-2">
     <a href="https://donorbox.org/support-lets-encrypt" class="btn btn-yellow btn-sm">Donate on Donorbox</a>
   </div>
Original file line number	Diff line number	Diff line change
Expand Up		@@ -54,4 +54,4 @@ Clients may [request a "shortlived" certificate](https://letsencrypt.org/2025/02

		## IP Address Certificates

		Shortlived certificates (see above) can request that the certificate [contain IP Addresses](https://letsencrypt.org/2025/02/20/first-short-lived-cert-issued/) in its Subject Alternative Names. These addresses will be [validated in much the same way as DNS Names](https://www.rfc-editor.org/rfc/rfc8738.html) are today.
		Shortlived certificates (see above) can request that the certificate [contain IP Addresses](https://letsencrypt.org/2025/02/20/first-short-lived-cert-issued/) in its Subject Alternative Names. These addresses are [validated in much the same way as DNS Names](https://www.rfc-editor.org/rfc/rfc8738.html) are today.