Free vs paid SSL certificates: what the extra money buys

The short version

• Most sites do not need to buy a certificate. Let’s Encrypt, ZeroSSL, Cloudflare and nearly every host and website builder give you one for $0 and renew it for you.
• Free and paid certificates prove the same thing about your domain name. The CA/Browser Forum rules say every certificate type gives “the same level of assurance” about the domain; paid types add checks on who owns it.
• Paid prices run from $5.99 a year (Namecheap’s basic certificate on a 5-year term) to $995 or more (DigiCert’s EV). Many multi-year deals still need a fresh install about every 200 days, as of October 2026.
• Paying makes sense when you need your company’s legal name in the certificate, a wildcard or multi-domain certificate your host does not include, or a warranty that pays you.

What you get for free

An SSL certificate is the small file that lets a browser open your site over HTTPS. The company that issues it is called a certificate authority (CA). Free certificates are Domain Validated (DV): the CA checks only that you control the domain.

Let’s Encrypt says plainly: “We do not charge a fee for our certificates.” It issues DV only and has no plans to offer OV or EV. Cloudflare’s Universal SSL is on every plan, including Free, and is issued once your domain is active on Cloudflare, a step you complete in your domain’s DNS settings.

Hosts and builders mostly build this in. Hostinger, SiteGround, InMotion, Kinsta, Cloudways, WP Engine, Wix, Squarespace, Shopify and WordPress.com all include free SSL, according to their own pages. A few limits are worth knowing:

• WP Engine gives free single-domain certificates only. A wildcard, EV or multi-domain certificate has to come from a third party.
• DreamHost says wildcard certificates are currently not supported. Hostinger supports wildcards only on VPS plans.
• Wix needs a paid plan to connect your own domain, and Webflow’s free Starter plan publishes only to webflow.io.
• Squarespace and Shopify do not let you install a certificate you bought elsewhere.

Our SSL by platform guide covers each host and builder in detail.

What paid certificates cost

Prices below are the figures each seller shows, in US dollars before tax. Many sellers show a low per-year rate that needs a long term, so read the term and renewal columns.

A few notes so you can check the table:

• Namecheap now sells SSL.com certificates. Its old PositiveSSL is renamed Standard SSL. Namecheap says it is usually issued in 15 minutes or less.
• GoDaddy shows its DV, OV, EV and wildcard prices only per month on a 3-year term, with no 1-year or renewal price. GoDaddy also says its self-managed DV certificates revalidate automatically only for domains registered with GoDaddy; other domains need each reissue installed by hand.
• Sectigo sells 1 to 6-year subscriptions. Its DV page says DV “starts at $88” on a six-year subscription but does not say whether that is per year.
• DigiCert lists only OV and EV on its compare page, with no DV product. Its prices do not match from page to page: the compare page shows Basic at $218, while the Basic product page shows $26 a month per standard domain on a 12-month subscription that renews automatically. Check the price in your cart before you pay.
• ZeroSSL paid plans start at $14.99 a month billed yearly (Basic, 5 annual certificates).
• Hosts upsell too. Bluehost says most of its hosting plans include a free Let’s Encrypt certificate, but it also sells a Single Domain DV certificate at $3.33 a month for 12 months, renewing at $7.49 a month.

Why “5 years” does not mean one install

Public certificates issued since March 15, 2026 can last no more than 200 days. That limit drops to 100 days on March 15, 2027 and to 47 days on March 15, 2029, under rules all four major browser makers voted for.

So a multi-year purchase is a subscription, not one long certificate. Namecheap’s product pages say the certificate “should be reissued every 200 days for free.” ZeroSSL says its annual certificates must be renewed by day 199. If nothing automates that, someone has to log in, reissue and reinstall, more often each year.

This is the biggest hidden cost of a paid certificate. Free certificates from your host or Cloudflare renew themselves. Miss a manual renewal and browsers show visitors a security warning instead of your site; see how to fix SSL errors.

What a certificate warranty is

Paid certificates often advertise a warranty in the thousands or millions of dollars. It only pays when the CA itself made a mistake issuing the certificate, and the two big CAs set theirs up differently:

• Sectigo pays relying parties: a person who completed an online financial transaction with your site, if Sectigo did not use reasonable care in validation. Its agreement says the certificate buyer is not a relying party, so you, the site owner, are not paid. Limits run from $5,000 per transaction and $50,000 total (PositiveSSL DV) to $10,000 per transaction and $1,750,000 total (SectigoSSL EV).
• DigiCert NetSure pays the certificate buyer for direct damages caused by DigiCert breaking its issuance warranties. Limits run from $10,000 (RapidSSL DV) to $2,000,000 (Secure Site Pro EV).

Neither one works like insurance for your website. Read the CA’s agreement, linked below, before you count on it.

When paying makes sense

• You need your legal name in the certificate. OV and EV certificates include an organization name the CA has verified. Free certificates cannot. Visitors rarely see it: Chrome moved the EV company name into the Page Info panel in Chrome 77 (2019), though Firefox still shows it in its connection panel. Our certificate types guide explains DV, OV and EV.
• Your host does not include what you need. For example, a wildcard or multi-domain certificate on WP Engine, which you import on a plan that allows it.
• You want a warranty that pays you. That points to DigiCert’s model, not Sectigo’s.
• Your server cannot run automatic renewal. Even then, a paid certificate still needs reissuing about every 200 days.

How to decide in 4 steps

1. Open your site and click the icon to the left of the address in Chrome. If the connection is secure, you already have a certificate. Check who issued it in the certificate details.
2. Look up your host’s or builder’s SSL help page. If it says free SSL renews automatically, you are done.
3. Ask whether anyone has asked you for OV or EV, a wildcard, or a warranty. If not, stay on the free certificate.
4. If you do buy, compare the first-term price with the renewal price, and set a reminder to reissue the certificate before each 200-day limit (100 days for certificates issued from March 15, 2027).

Not sure your setup is right? Start at the SSL certificates hub, or see when to hire help.

Sources

Rules: CA/Browser Forum Baseline Requirements, Ballot SC-081v3. Free options: Let’s Encrypt FAQ, Let’s Encrypt 64-day certificates, ZeroSSL pricing, Cloudflare Universal SSL, Cloudflare certificate validity. Prices: Namecheap SSL, Namecheap Standard SSL, Namecheap Standard Wildcard, Namecheap EV, Namecheap reissue note, GoDaddy SSL, GoDaddy EV, Sectigo SSL, Sectigo DV, Sectigo EV, Sectigo compare, DigiCert compare, DigiCert Basic, Bluehost SSL pricing. Hosts: WP Engine, DreamHost, Hostinger wildcard, Squarespace, Shopify. Warranties: Sectigo Relying Party Agreement, DigiCert NetSure Protection Plan. Browsers: Chrome identity indicators, Firefox connection panel.