SSL certificates: free and paid
A free certificate encrypts the connection just as reliably as a paid one: browsers make no distinction between them in terms of security. The difference lies in what the certificate authority checks, how long the certificate lasts and who is responsible for renewing it. According to the accsly.io catalog as of November 2026, free SSL is explicitly listed in 1,449 shared hosting plans from 178 hosts. Here is when that is enough and when a certificate is worth paying for.
The word "SSL" is a leftover from an old protocol: today the connection is protected by TLS, and the certificate confirms that the encryption key belongs to the owner of the domain. Without a certificate, the browser marks the site as not secure, login and payment forms show warnings, and search engines treat HTTPS as a baseline requirement for normal rankings. Below are the types of certificates, how paid ones differ from free ones and how to keep a certificate from expiring on your own server.
DV, OV and EV: what exactly is checked
Certificates are classified by how the owner is validated. Encryption is the same for all three types; the only thing that changes is what the certificate authority has confirmed before issuing it.
- DV (domain validation) only checks that you control the domain, using a file on the site or a DNS record. It is issued automatically within minutes. All free certificates are DV.
- OV (organization validation) also checks the company: registration documents, address and phone number. The organization's name is written into the certificate. Issuance takes from one to several days.
- EV (extended validation) is the strictest company check. Browsers used to display it as a green bar with the company name, but Safari dropped this in 2018, and in 2019, starting with version 77, Chrome moved EV information into the Page Info panel: research showed that users did not pay attention to it.
The takeaway for a typical website, blog or online shop: DV is enough. A paid OV or EV certificate is needed when a counterparty, a bank, tender conditions or an internal security policy require it, not for the sake of a badge in the browser.
Free certificates: Let's Encrypt and ZeroSSL
Free certificate authorities issue certificates over the ACME protocol (RFC 8555): a program on the server validates the domain, obtains the certificate and renews it on its own. The best-known of these authorities is Let's Encrypt; another example is ZeroSSL, which also issues free 90-day certificates via ACME, including wildcards.
A short lifetime is the main difference of free certificates, and it is getting even shorter. Let's Encrypt currently issues 90-day certificates and has announced a move to 45 days: from 13 May 2026 this lifetime is available as an option, from 10 February 2027 the default will be 64 days, and from 16 February 2028 it will be 45. There are also rate limits: no more than 50 certificates per registered domain and 5 identical ones within 7 days. That is plenty for an ordinary site, and while you are debugging your setup it is better to use the authority's staging environment so you do not hit the limit.
Paid certificates are no longer annual either. Under CA/Browser Forum ballot SC-081v3, the maximum lifetime of any public certificate is 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. A "one-year certificate" now means a subscription during which the certificate has to be reissued. So automation is needed whatever you choose, and the argument that "a paid certificate is installed once a year and forgotten" no longer holds.
When a paid certificate makes sense
- you need the organization's name in the certificate, that is, OV or EV at the request of a partner, payment provider or regulator;
- a server or device does not support ACME and the certificate has to be installed manually, in which case a paid authority provides support and reissue reminders;
- the company needs a single supplier with a contract, invoices and the paperwork its accountant requires.
The warranty payouts advertised in descriptions of paid certificates cover a mistake made by the certificate authority itself during issuance, not a hacked website. Choosing a certificate by the size of that warranty is not worth it.
Wildcards and certificates for several names
A wildcard certificate for *.example.com covers all subdomains at one level: shop.example.com, api.example.com. It does not cover example.com itself or second-level subdomains such as a.b.example.com; those are added to the certificate as separate names.
Let's Encrypt issues wildcards only with DNS validation (DNS-01): the program on the server has to create a TXT record in the domain's zone. For automatic renewal it needs an API key from the DNS provider, and that key, stored on the server, grants the right to change every record of the domain. If there are only a few subdomains and they are known in advance, it is simpler to issue one certificate listing all the names using ordinary HTTP validation. How DNS records work is explained in the article Domains and DNS for a server owner.
What hosting plans include
On shared hosting, certificates are usually handled by the control panel: cPanel, ISPmanager and others obtain a free certificate for the domain and renew it themselves. According to the accsly.io catalog as of November 2026, free SSL is listed in 1,449 plans from 178 hosts, while only 47 plans from three hosts explicitly come without it. In total the catalog has 8,998 shared hosting plans from 1,655 hosts, and for most of them the plan page simply does not mention this condition, which does not mean there is no certificate. Before buying, check whether the free certificate covers all the domains and subdomains of the plan. Plans are collected in the sections Website hosting and Hosting for WordPress.
On a VPS, nobody installs a certificate by default: that is the server owner's job. The exception is servers with a panel: ISPmanager, FASTPANEL, aaPanel and similar panels issue Let's Encrypt certificates from their interface, and they are compared in the article Server control panels: ISPmanager, FASTPANEL, aaPanel. Paid certificates that hosts sell as an add-on are issued by the same certificate authorities, so it is worth comparing the price with what the authority itself charges.
A certificate on a VPS: certbot and renewal
On a server without a panel, the easiest way to get a certificate is the certbot program. For nginx it takes one command: certbot --nginx -d example.com -d www.example.com. Certbot validates the domain over HTTP, adds the certificate to the configuration and enables the redirect to HTTPS. The files are stored in /etc/letsencrypt/live/example.com/.
Renewal is set up during installation: according to the certbot documentation, the certbot renew job runs twice a day, and the certificate is reissued when less than a third of its lifetime remains. You can check that renewal will succeed with certbot renew --dry-run and see the timer with systemctl list-timers | grep certbot. If the certificate is used not only by the web server but also, for example, by a mail server, add --deploy-hook with a command that reloads that service: otherwise it will keep serving the old file.
There will be no more email reminders: Let's Encrypt stopped sending expiration emails on 4 June 2025. So it is best to add certificate expiry to your monitoring; how to set it up is described in the article Server monitoring: uptime, load, alerts.
Common mistakes
- Port 80 is closed. HTTP-01 validation only uses port 80, so the firewall must allow it even if the site runs on HTTPS only. Firewall setup is covered in the article First 10 steps after buying a VPS: security.
- The domain points to another server. During a move, validation goes to the old address. Get the certificate after the DNS records have been changed or use DNS validation, as described in the article How to move a website from shared hosting to a VPS.
- www or a subdomain was forgotten. A certificate is valid only for the names listed in it, and the browser shows an error on
www.example.comif onlyexample.comwas issued. - Incomplete chain. The web server configuration should use
fullchain.pem, notcert.pem: without the intermediate certificate, some devices will not open the site. - Mixed content. The page is opened over HTTPS, but images and scripts load over
http://, so the browser blocks them or removes the security indicator. - HSTS without testing. The HSTS header (RFC 6797) forbids the browser from opening the site over HTTP. If you enable it with a long lifetime and
includeSubDomainsbefore every subdomain has a certificate, those subdomains will be unreachable for visitors for that whole period. - A CAA record. A CAA DNS record (RFC 8659) lists the authorities allowed to issue certificates for the domain. If it names only one authority, any other will refuse to issue.