Free vs Paid SSL Certificates: What You Actually Need

Let us settle the main question immediately, because most articles on this take four hundred words to avoid it.

A free certificate from Let's Encrypt encrypts your traffic exactly as strongly as a certificate costing $300 a year. Identical algorithms, identical key lengths, identical protection against interception. Any page telling you a paid certificate is "more secure" is selling one.

What money buys is not encryption. It is identity verification and a warranty. Those are real products with real uses, and most websites need neither. This article is about telling which you are.

What a certificate actually does

Two separate jobs, and conflating them is where the confusion starts.

Encryption. Everything between the browser and the server is scrambled. This is what stops someone on the café wi-fi reading a password. Every certificate does this identically, free or paid.

Identity. The certificate asserts who is on the other end. This is where they differ, and it is entirely about how hard the certificate authority checked before issuing.

That is the whole distinction. Everything below follows from it.

The three validation levels

DV proves the domain. A visitor learns that they are talking to the real example.com and not an impostor — which is exactly what the padlock has always meant.

OV additionally puts your legal company name inside the certificate. Nobody sees it without clicking through two dialogs, but it is inspectable, and some procurement processes and payment providers require it.

EV used to give you the green address bar with your company name in it. Browsers removed that display years ago — Chrome and Firefox both dropped it around 2019 after research found it did not change user behaviour. So the visible benefit EV was sold on no longer exists. It is still occasionally mandated by contract, which is now essentially the only reason to buy one.

So when should you actually pay?

Four situations, and only four.

1. You need a wildcard certificate. One certificate covering *.example.com — any subdomain, including ones you have not created yet. Let's Encrypt does issue wildcards free, but only via DNS-01 validation, which means your DNS provider needs an API and your ACME client needs to drive it. If your setup cannot do that, buying one is a reasonable purchase of convenience.

2. Something external requires OV or EV. A bank, a payment processor, a government tender, an enterprise security questionnaire. When it is a contractual requirement it is not a technical decision and there is nothing to weigh.

3. You want a warranty. Paid certificates carry a warranty — sometimes advertised at over a million dollars. Read what it actually covers: it pays the end user if they lose money because the CA mis-issued a certificate. It does not pay you if your site is breached. Genuine, and almost never claimed.

4. Your platform cannot automate renewal, and you would rather buy time. A longer manual certificate used to mean fewer renewals. As of 2026 this argument has largely collapsed — see the next section.

If none of those four apply, use a free certificate. You are not being cheap; you are buying the correct product.

The 2026 change that matters more than the price

In March 2026 the CA/Browser Forum cut the maximum lifetime of a publicly trusted certificate from 398 days to 200 days, and it will keep shrinking in later steps.

This quietly demolishes the main practical argument for buying: you can no longer purchase a certificate and forget about it for a year. Everyone renews at least twice a year now, whether they paid or not.

The consequence is that the important question is no longer "free or paid". It is "does renewal happen without a human". An automated free certificate is strictly better than a manual paid one, because the failure mode of a manual certificate is a full-page browser security warning on your homepage on a day nobody was watching the calendar.

Let's Encrypt has always issued 90-day certificates precisely to force automation. That looked like a drawback for a decade. It now looks like foresight.

Getting a free certificate

On cPanel hosting there is essentially nothing to do. AutoSSL issues and renews a certificate for every domain on the account automatically. Check Security → SSL/TLS Status — if your domains show a green padlock, it is done, and a free certificate comes with every one of our hosting plans.

Two things that break AutoSSL, both worth knowing:

• The domain must resolve to that server. If DNS still points elsewhere, validation fails silently and the certificate never issues.
• A subdomain that is not reachable over http will not validate. Redirects and password protection on the validation path both break it.

On your own server, certbot handles issuance and installs a systemd timer that renews automatically:

sudo certbot --nginx -d example.com -d www.example.com
sudo certbot renew --dry-run

The dry run is the step that matters — it proves renewal works now, rather than discovering in seventy days that it does not.

Getting it right, whichever you buy

The certificate is rarely the problem. The configuration usually is.

• Cover both example.com and www.example.com. A certificate for one and a visitor arriving at the other is a security warning. This is the single most common misconfiguration.
• Redirect http to https, once, at the server. Not a chain of three redirects.
• Fix mixed content. A page loaded over https that pulls an image over http loses the padlock. In WordPress this is usually old hard-coded URLs in the database.
• Serve the full chain. Browsers often paper over a missing intermediate certificate; some Android devices and API clients do not, and you get "works for me" bug reports that are real.
• Enable HSTS after you are confident https works everywhere, not before. It is deliberately hard to undo.
• Monitor expiry externally. Even automated renewal fails sometimes.

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -dates -issuer -subject

What a certificate does not do

Worth saying plainly, because the padlock is widely over-read.

• It does not mean a site is trustworthy. A phishing site can get a free DV certificate in seconds, and most do. The padlock means "encrypted", not "honest".
• It does not protect a vulnerable application. SQL injection over https is still SQL injection. See securing a Linux server for the layer that does.
• It is not a meaningful ranking factor any more. https has been a signal since 2014, but it is now so universal that having it is table stakes rather than an advantage. What does matter is not breaking it — see Core Web Vitals and technical SEO.

The short version

What actually happens when a certificate expires

Worth knowing, because the failure is far more severe than most people expect and it shapes how seriously you should take renewal.

The browser does not show a small warning. It shows a full-page interstitial — "Your connection is not private", red, with the site's content hidden behind it. Continuing requires clicking through an "Advanced" link that most visitors will not find and should not use.

The consequences compound:

• Every visitor is blocked, including returning customers who trust you.
• Your API stops working. Anything calling your site programmatically fails on certificate validation, usually with no useful message. Mobile apps break.
• Payment integrations fail, since webhooks and callbacks validate certificates strictly.
• Email breaks, if the same certificate covers your mail hostname.
• Search crawling stops. Google will not index a site behind a certificate error.

And it happens at whatever moment the certificate lapses — typically overnight, on a weekend, when the person who knows about it is unreachable.

This is why the 2026 shortening of certificate lifetimes matters more than the free-versus-paid question. Two defences, both cheap:

1. Automate renewal, and prove it works with a dry run rather than assuming.
2. Monitor expiry from outside your infrastructure. A check that alerts at 21, 14 and 7 days costs nothing and catches the case where automation silently stopped running months ago.

The second one is the one people skip, and it is the one that catches the real failure — because automated renewal does not fail loudly. It fails silently, and you find out from a customer.

Frequently asked questions

Is a free SSL certificate less secure than a paid one? No. The encryption is identical — same algorithms, same key strengths, same browser trust. The difference is how much identity checking the certificate authority did before issuing, which is a business question, not a security one.

Do Let's Encrypt certificates work in all browsers? Yes. Let's Encrypt is trusted by every current browser and operating system. Extremely old devices — think pre-2016 Android — can have trouble, which is a compatibility footnote rather than a real constraint in 2026.

Why do certificates now expire so quickly? The CA/Browser Forum cut maximum validity to 200 days in March 2026, and it is scheduled to shrink further. Shorter lifetimes limit the damage a stolen key can do and force automation. Practically: make sure renewal is automated and monitored.

Do I need SSL if my site does not take payments? Yes. Browsers mark plain http pages "Not secure", which visitors notice, and any form at all — including a contact form — sends data in the clear without it. It is free on any competent host, so there is no case for going without.

Will an EV certificate increase trust or conversions? There is no visible difference to a normal visitor any more; browsers stopped showing the company name in the address bar years ago. Claims about conversion uplift come from certificate resellers and generally predate that change.

Can I move a paid certificate to a new host? Yes, if you have the private key. Copy the certificate, the key and the intermediate chain across. In practice it is often less work to issue a fresh free certificate on the new server and keep the paid one for whichever domain actually required it.