Fix a number of typos and mistakes (#2187)

Author: bdaehlie

content/en/certificates.md

@@ -287,7 +287,7 @@ These intermediate CAs are no longer being used to issue Subscriber certificates
 
 # Chains
 
-When an ACME client downloads a newly-issued certificate from Let's Encrypt's ACME API, that certificate comes as part of a "chain" that also includes one or more intermediates. Usually this chain consists of just the end-entity certificate and one intermediate, but it could contain additional intermediates. The idea is that, by presenting this whole chain of certificates to a website visitor's browser, the browser will be able to validate the signatures all the way up to a root that browser trusts without having to download any additional intermediates.
+When an ACME client downloads a newly-issued certificate from Let's Encrypt's ACME API, that certificate comes as part of a "chain" that also includes one or more intermediates. Usually this chain consists of just the end-entity certificate and one intermediate, but it could contain additional intermediates. The idea is that, by presenting this whole chain of certificates to a website visitor's browser, the browser will be able to validate the signatures all the way up to a root that the browser trusts without having to download any additional intermediates.
 
 Sometimes there's more than one valid chain for a given certificate: for example, if an intermediate has been cross-signed, then either one of those two certificates could be the second entry, "chaining up to" either of two different roots. In this case, different website operators may want to select different chains depending on the properties that they care about the most.
 

content/en/docs/a-warm-welcome-to-asn1-and-der.md

@@ -153,7 +153,7 @@ requirements](https://community.letsencrypt.org/t/2018-03-12-wildcard-certificat
 IA5String, based on [International Alphabet No.
 5](https://en.wikipedia.org/wiki/T.50_(standard)),
 is more permissive: It allows nearly any ASCII character, and is used
-for email address, DNS names, and URLs in certificates. Note that there
+for email addresses, DNS names, and URLs in certificates. Note that there
 are a few byte values where the IA5 meaning of the byte value is
 different than the US-ASCII meaning of that same value.
 

content/en/docs/challenge-types.md

@@ -148,7 +148,7 @@ Cons:
 # TLS-SNI-01
 
 This challenge was defined in draft versions of ACME. It did a TLS
-handshake on port 443 and sent a specific [SNI] header, looking for
+handshake on port 443 and sent a specific [SNI] header, looking for a
 certificate that contained the token. It [was removed in March
 2019][tls-sni-disablement] because it was not secure enough.
 

content/en/docs/client-options.md

@@ -19,7 +19,7 @@ and increases the risk of missed renewals.
 
 # Recommended: Certbot
 
-We recommend that most people start with the [Certbot](https://certbot.eff.org/) client. It can simply get a cert for you or also help you install, depending on what you prefer. It's easy to use, works on many operating systems, and has great documentation.
+We recommend that most people start with the [Certbot](https://certbot.eff.org/) client. It can simply get a cert for you or also help you install it, depending on what you prefer. It's easy to use, works on many operating systems, and has great documentation.
 
 If Certbot does not meet your needs, or you'd simply like to try something else, there are many more clients to choose from below, grouped by the language or environment they run in.
 

content/en/docs/glossary.md

@@ -73,7 +73,7 @@ Note for translators:
 
 {{% def id="CN" name="Common Name" abbr="CN" %}} Part of a certificate's [Subject](#def-subject) describing what the certificate is about. For [roots](#def-root) and [intermediates](#def-intermediate) it's the human-readable name of the [certificate authority](#def-CA). For [leaf certificates](#def-leaf) it's one of the domain names on the certificate. Note: The common name is limited to 63 characters. It is an obsolete method of indicating a domain name to which the certificate applies, since current Internet standards expect software to check only the [Subject Alternative Names](#def-SAN) in order to determine the applicability of a certificate. {{% /def %}}
 
-{{% def id="cross-signing" name="Cross Signing" %}} An issuing certificate may be signed by more than one [root](#def-root). For example, [Let's Encrypt](#def-LE) [intermediates](#def-intermediate) are cross signed by [IdenTrust](#def-IdenTrust), because at launch the Let's Encrypt root was not yet trusted by [certificate stores](#def-store). Technically, it's achieved with two issuing certificates, using the same [Subject](#def-subject) and the same [Key-pair](#def-key-pair), one signed by the private key of a Let's Encrypt root and the other signed by the private key of an IdenTrust's root: [/certificates](/certificates). [Wikipedia](https://en.wikipedia.org/wiki/X.509#Certificate_chains_and_cross-certification) {{% /def %}}
+{{% def id="cross-signing" name="Cross Signing" %}} An issuing certificate may be signed by more than one [root](#def-root), possibly from different CAs. When one CA signs another CA's certificate, it's called cross-signing. {{% /def %}}
 
 {{% def id="DANE" name="DNS-based Authentication of Named Entities" abbr="DANE" %}} A mechanism using DNS to indicate how to verify the authenticity of the [certificate](#def-leaf) or encryption key presented.  [Wikipedia](https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities) {{% /def %}}
 
@@ -99,7 +99,7 @@ Note for translators:
 
 {{% def id="IDNA" name="Internationalized Domain Names for Applications" abbr="IDNA" %}} See [internationalized domain name](#def-IDN). {{% /def %}}
 
-{{% def id="IDN" name="Internationalized Domain Name" abbr="IDN" %}} Domain name with characters other than `a` to `z`, `0` to `9` and the hyphen (`-`). They can for example contain Arabic, Chinese, Cyrillic, Tamil, Hebrew or Latin alphabet-based characters with diacritics or ligatures. The encoded representation of an IDN domains starts with `xn--`. IDNs are supported by [Let's Encrypt](#def-LE): https://letsencrypt.org/2016/10/21/introducing-idn-support.html. [Wikipedia](https://en.wikipedia.org/wiki/Internationalized_domain_name) - [RFC 5890](https://tools.ietf.org/html/rfc5890) - [RFC 5891](https://tools.ietf.org/html/rfc5891) {{% /def %}}
+{{% def id="IDN" name="Internationalized Domain Name" abbr="IDN" %}} Domain name with characters other than `a` to `z`, `0` to `9` and the hyphen (`-`). They can for example contain Arabic, Chinese, Cyrillic, Tamil, Hebrew or Latin alphabet-based characters with diacritics or ligatures. The encoded representation of an IDN domain starts with `xn--`. IDNs are supported by [Let's Encrypt](#def-LE): https://letsencrypt.org/2016/10/21/introducing-idn-support.html. [Wikipedia](https://en.wikipedia.org/wiki/Internationalized_domain_name) - [RFC 5890](https://tools.ietf.org/html/rfc5890) - [RFC 5891](https://tools.ietf.org/html/rfc5891) {{% /def %}}
 
 {{% def id="ISRG" name="Internet Security Research Group" abbr="ISRG" %}} The organization behind [Let's Encrypt](#def-LE): [https://www.abetterinternet.org/about/](https://www.abetterinternet.org/about/). [Wikipedia](https://en.wikipedia.org/wiki/Internet_Security_Research_Group) {{% /def %}}
 

content/en/docs/integration-guide.md

@@ -74,7 +74,7 @@ If you're using the http-01 ACME challenge, you will need to provision the chall
 
 Additionally, when using the dns-01 challenge, make sure to clean up old TXT records so the response to Let's Encrypt's query doesn't get too big.
 
-If you want to use the http-01 challenge anyhow, you may want to take advantage of HTTP redirects. You can set up each of your frontends to redirect `/.well-known/acme-validation/XYZ` to `validation-server.example.com/XYZ` for all `XYZ`. This delegates responsibility for issuance to `validation-server`, so you should protect that server well.
+If you want to use the http-01 challenge anyhow, you may want to take advantage of HTTP redirects. You can set up each of your frontends to redirect `/.well-known/acme-challenge/XYZ` to `validation-server.example.com/XYZ` for all `XYZ`. This delegates responsibility for issuance to `validation-server`, so you should protect that server well.
 
 # Central Validation Servers
 

content/en/docs/rate-limits.md

@@ -157,7 +157,7 @@ client to use our [staging environment](/docs/staging-environment), which has
 ### Workaround
 
 If you've hit this limit, you can change the set of identifiers by adding
-`blog.example.com`, to request additional certificates. Be aware that these new
+`blog.example.com` to request additional certificates. Be aware that these new
 orders would not be considered renewals. Therefore, they would be subject to the
 [New Orders per Account](#new-orders-per-account) and [New Certificates per
 Registered Domain](#new-certificates-per-registered-domain) rate limits.

content/en/post/2017-1-6-le-2016-in-review.markdown

@@ -26,7 +26,7 @@ Let’s Encrypt exists in order to help create a 100% encrypted Web. Our own met
 
 We learned some lessons this year. When we had service interruptions they were usually related to managing the rapidly growing database backing our CA. Also, while most of our code had proper tests, some small pieces didn’t and that led to [incidents](https://community.letsencrypt.org/c/incidents) that shouldn’t have happened. That said, I’m proud of the way we handle incidents promptly, including quick and transparent public disclosure.
 
-We also learned a lot about our client ecosystem. At the beginning of 2016, ISRG / Let’s Encrypt provided client software called letsencrypt. We’ve always known that we would never be able produce software that would work for every Web server/stack, but we felt that we needed to offer a client that would work well for a large number of people and that could act as a reference client. By March of 2016, earlier than we had foreseen, it had become clear that our community was up to the task of creating a wide range of quality clients, and that our energy would be better spent fostering that community than producing our own client. That’s when we made the decision to [hand off development of our client](https://letsencrypt.org/2016/03/09/le-client-new-home.html) to the Electronic Frontier Foundation (EFF). EFF renamed the client to [Certbot](https://certbot.eff.org/) and has been doing an excellent job maintaining and improving it as one of [many client options](https://letsencrypt.org/docs/client-options/).
+We also learned a lot about our client ecosystem. At the beginning of 2016, ISRG / Let’s Encrypt provided client software called letsencrypt. We’ve always known that we would never be able to produce software that would work for every Web server/stack, but we felt that we needed to offer a client that would work well for a large number of people and that could act as a reference client. By March of 2016, earlier than we had foreseen, it had become clear that our community was up to the task of creating a wide range of quality clients, and that our energy would be better spent fostering that community than producing our own client. That’s when we made the decision to [hand off development of our client](https://letsencrypt.org/2016/03/09/le-client-new-home.html) to the Electronic Frontier Foundation (EFF). EFF renamed the client to [Certbot](https://certbot.eff.org/) and has been doing an excellent job maintaining and improving it as one of [many client options](https://letsencrypt.org/docs/client-options/).
 
 As exciting as 2016 was for Let’s Encrypt and encryption on the Web, 2017 seems set to be an even more incredible year. Much of the infrastructure and many of the plans necessary for a 100% encrypted Web came into being or solidified in 2016. More and more hosting providers and CDNs are supporting HTTPS with one click or by default, often without additional fees. It has never been easier for people and organizations running their own sites to find the tools, services, and information they need to move to HTTPS. Browsers are planning to update their user interfaces to better reflect the risks associated with non-secure connections.
 

content/en/post/2019-10-09-onboarding-your-customers-with-lets-encrypt-and-acme.md

@@ -77,7 +77,7 @@ change their A records to point at a different CDN, without telling you
 that their plans have changed. You should monitor for this situation and
 stop attempting to issue certificates. If the customer has left behind a
 CNAMEd `_acme-challenge` subdomain that points at you, you should
-contact that and remind them to delete it. The CNAMEd subdomain
+contact them and remind them to delete it. The CNAMEd subdomain
 represents a delegated authorization to issue certificates, and cleaning
 up that delegation improves both the customer’s security posture and
 your own. Similarly, if a customer sets up the CNAME and you issue a

content/en/post/2026-03-17-acme-renewal-information-ari.md

@@ -54,7 +54,7 @@ renewal_info = client.renewal_info(certificate: existing_certificate_pem)
 
 This method generates an ARI certificate identifier that can be used when making the API call. The client also includes a helper method, `suggested_renewal_time`, which chooses a random time between the returned start and end dates. The certificate identifier can be passed to the `new_order` method via the `replaces` key, which can grant a higher priority or bypass rate limits for renewals occurring during the window, depending on the CA's policies.
 
-Critically, Shopify also regularly polls the ARI endpoint for updated renewal timestamps. This allows our systems to rely on those timestamps as the primary renewal timing logic and removes the need for inflexible hard-coded expiry thresholds. This becomes the mechanism that LetsEncrypt uses to dynamically change the renewal time due to a revocation event.
+Critically, Shopify also regularly polls the ARI endpoint for updated renewal timestamps. This allows our systems to rely on those timestamps as the primary renewal timing logic and removes the need for inflexible hard-coded expiry thresholds. This becomes the mechanism that Let's Encrypt uses to dynamically change the renewal time due to a revocation event.
 
 ### Results and rewards