A free SSL certificate encrypts your website exactly as well as a paid one. The difference is in what sits around the encryption: paid certificates can include checks on your business’s identity, a warranty and vendor support. For most small business websites, a free certificate that renews itself automatically is the better choice. Paying every year for a basic certificate buys almost nothing.
Key takeaways
- Free and paid certificates use the same encryption. Visitors see the same padlock.
- Paid organisation (OV) and extended (EV) certificates verify your business, but browsers no longer show that in the address bar.
- Certificate warranties typically protect the visitor in narrow cases, not you.
- Certificates now last 200 days at most, so automatic renewal matters more than the brand on the certificate.
Is a free SSL certificate as secure as a paid one?
Yes. The encryption between a visitor’s browser and your server is set by your server and the browser, not by the price of the certificate. A free certificate and a paid one with the same key type give the same protection.
The best-known free provider is Let’s Encrypt, a non-profit certificate authority. It charges no fee, issues domain-validated (DV) certificates only and makes them valid for 90 days, renewed automatically (Let’s Encrypt). If you’re still deciding whether you need SSL at all, our guide to the SSL certificate basics covers that first.
Free SSL vs paid SSL: how do they compare?
| Free DV | Paid DV | Paid OV or EV | |
|---|---|---|---|
| Encryption | Same | Same | Same |
| What’s checked | You control the domain | You control the domain | Your business is real and registered |
| What visitors see | Padlock | Padlock | Padlock. Business name only in the certificate details |
| Renewal | Automatic, usually by your host | Often manual | Manual, with paperwork |
| Warranty | None | Usually small | Larger |
| Who needs it | Almost every small business | Rarely anyone | Some tenders, banks and large clients |
What are you actually paying for?
Identity checks that visitors rarely see
OV and EV certificates confirm that a registered organisation stands behind the domain. That once meant a green bar with the company name. Since Chrome 77 in 2019, Chrome shows that detail only when someone clicks into the site information (Chromium). Most visitors never do.
A warranty that isn’t for you
Certificate warranties sound like insurance for your business. Read the terms. SSL.com’s warranty, for example, covers a visitor’s loss from a fraudulent card transaction caused by the certificate authority’s negligence, and says the subscriber (you) is not a beneficiary (SSL.com).
Multi-year terms that now need regular reinstalling
Industry rules now cap every public certificate at 200 days, falling to 100 days in March 2027 and 47 days in March 2029 (Sectigo, CA/Browser Forum). A “two-year” paid certificate is now a subscription you reissue and reinstall several times. Each manual step is a chance to miss a date, and then visitors see a full-page warning. Our guide to an SSL certificate expired error explains how to recover if that happens.
When does a paid SSL certificate still make sense?
- A contract or tender requires it. Some government, banking and enterprise clients ask suppliers for an OV or EV certificate.
- A payment or partner integration asks for it. Rare, but check their written requirements rather than a sales email.
- The system can’t renew automatically. Some older appliances or hosted platforms need certificates installed by hand. Fix the automation if you can.
- You need one certificate across many unusual names. Free certificates cover wildcards and several names too, so check before you buy.
How do I check what I’m paying for now?
- Look at the certificate. Click the icon to the left of your address in Chrome, open the connection details and view the certificate. Note the issuer and the expiry date.
- Find the invoice. Search your email for “SSL” or the issuer’s name. Check what you pay and when it renews.
- Ask your host. Ask whether they offer free SSL that renews automatically, and whether it covers the www and non-www versions of your domain.
- Switch, then cancel. Install the free certificate, check every page loads securely, then cancel the paid renewal. If Chrome shows a warning afterwards, our guide to website not secure messages finds the cause.
How SSL works on our hosting
Every one of our hosting plans includes free SSL certificates that renew automatically, so there’s nothing to buy or diarise. If a client contract demands an OV or EV certificate, talk to us and we’ll help you install it. SSL is one layer of protection. Our secure web hosting page covers the rest.
Frequently asked questions
Does Google rank sites with paid SSL higher?
No. Google cares whether your site uses HTTPS, not who issued the certificate or what it cost. A free certificate from Let’s Encrypt counts exactly the same as an expensive EV certificate.
Is free SSL safe for an online store?
Yes. The encryption protecting card details and logins is the same. Payment security depends far more on your payment gateway, your updates and your hosting than on the certificate. Check your gateway’s requirements, but most accept any valid certificate.
Why do some hosts still sell SSL certificates?
Some customers genuinely need OV or EV certificates for contracts. Others are sold one out of habit, or because it’s a profitable add-on. Ask what the paid certificate gives you that a free one doesn’t, and get the answer in writing.
What is an EV certificate, and is it worth it?
Extended validation means the certificate authority checked your organisation in detail. Browsers used to show the company name in the address bar, but no longer do. It’s worth it only if a client or tender specifically requires it.
Do free SSL certificates expire?
Yes, every certificate does. Let’s Encrypt certificates last 90 days by default, but your host renews them automatically well before that. Problems usually only happen when DNS changes or a site moves, and automatic renewal can’t finish.
Sources
- Frequently asked questions, Let’s Encrypt
- EV UI moving to Page Info, Chromium
- Relying Party Warranty, SSL.com
- 200-day certificates are starting to expire, Sectigo, 23 September 2026
- Ballot SC-081v3: reducing validity and data reuse periods, CA/Browser Forum, April 2025