What Does An SSL Certificate Cost? (Usually Nothing)

You are on a checkout page. The line item says SSL certificate, and the total is somewhere between $60 and $400 a year depending on which one you clicked.

Before you pay it: for an ordinary website, an SSL certificate cost of zero is not a downgrade or a trial. It is the default, and has been since 2015.

Paid certificates are real products. A few situations still justify buying one, and I will go through them honestly, because "it is all free now" is not true either.

But the encryption is identical. A browser treats a free certificate and a $400 certificate exactly the same way, because it is the same padlock and the same maths behind it.

So the useful question is not the price. It is what a paid certificate validates that a free one does not, and whether a single visitor will ever see the difference.

What Does An SSL Certificate Cost In 2026?

Nothing, for most sites. A domain-validated certificate from Let's Encrypt is free, has been free since 2015, and nearly every host issues and renews one without being asked. If you buy instead, list prices run from about $8 a year for a discounted DV certificate to $500 or more for an EV wildcard.

Those are list prices and they move. Resellers discount the identical product heavily, first-year promotions are normal, and the renewal price is the one that matters.

You can buy from a certificate authority directly, such as DigiCert or Sectigo, or from a registrar or host that resells one, such as GoDaddy, Namecheap or most cPanel hosts. The certificate is the same object either way. The extra money buys a support desk and a management dashboard.

Free hosting has real limits, and I have written about where each free tier draws its line. The certificate is not one of them.

DV, OV And EV: What Each One Actually Checks

Three validation levels, one encryption. The difference is who the certificate authority checked before signing, and how much of that shows up anywhere a visitor can see.

Domain Validation (DV)

The authority checks exactly one thing: that you control the domain. You prove it with a file on the server or a record in DNS, machine to machine, and it is issued in seconds.

No paperwork, no phone call, no company required. This is what Let's Encrypt issues and what most of the web runs on.

Organisation Validation (OV)

The authority also checks that your organisation exists: a company registry lookup, sometimes a call to a number in a public directory.

It takes one to five business days and your legal entity name goes inside the certificate, where a visitor can see it only by opening the certificate details.

Extended Validation (EV)

The strictest vetting the CA/Browser Forum defines: registry checks, operational existence, a physical address and a verified callback.

EV used to buy the green address bar with your company name in it. Chrome removed that indicator in version 77 and Firefox in version 70, both in 2019, after research showed users did not notice it and were not protected by it. Chrome's update on the lock icon

So EV costs the most and is now invisible unless somebody digs into the certificate details.

Wildcard Or Single Domain?

A wildcard covers every subdomain one level deep: www.example.com, shop.example.com, staging.example.com, all from one certificate. A single-domain certificate covers one name, usually the bare domain and the www version as a pair.

Two things people get wrong here.

• Wildcards only go one level. A certificate for *.example.com does not cover a.b.example.com. That needs a second wildcard.
• Wildcards are not the only way to cover many names. One certificate can list up to 100 separate names, and if your subdomains are a known, stable list, naming them is cheaper and safer.

Free wildcards exist. Let's Encrypt has issued them since 2018, and the only catch is that the check happens in DNS rather than on the web server, so your host needs API access to add a record. Most managed hosts do it for you.

If yours does not, and you need one certificate across subdomains you cannot list in advance, buying a wildcard is a legitimate $50 to $300 answer. That is the most defensible purchase on this page.

Why The Padlock Does Not Mean Trusted Business

The padlock means one thing: the connection is encrypted and the certificate matches the name in the address bar. It says nothing about who is on the other end or whether they intend to rob you.

Phishing sites get certificates. They are free and automated, so of course they do. A page pretending to be your bank can hold a perfectly valid one and show the same indicator your bank shows.

This is why Chrome replaced the padlock with a neutral settings-style icon in 2023. Users read it as an endorsement of the site, which it was never designed to be.

So if you are buying because you think the visible trust signal improves, there is no visible trust signal to improve. There has not been one since 2019.

Let's Encrypt, And Why 90 Days Is A Feature

Let's Encrypt is a nonprofit certificate authority. It has issued free DV certificates since 2015, now covers hundreds of millions of domains, and what it signs is technically indistinguishable from a paid certificate.

Its certificates last 90 days. People read that as a chore. It is the opposite.

A short lifetime forces automation. Renewal is done by software on a schedule, usually around the 60-day mark, and once it works you never think about it again. Let's Encrypt on why certificates last ninety days

A one-year paid certificate forces nothing, which is exactly why so many of them expire on a Saturday.

The industry has already settled this argument anyway. Maximum certificate lifetime dropped to 398 days in 2020, fell to 200 days in March 2026, drops to 100 days in March 2027, and reaches 47 days in March 2029. Manual annual renewal is being retired by the browsers themselves.

If your site is a folder of files on a static host, you never touch any of this. The host runs the renewal client.

What Actually Breaks When A Certificate Expires

A full-page block, not a small warning. Chrome shows an interstitial with NET::ERR_CERT_DATE_INVALID and a button most people never click. Your homepage becomes a security warning and the bounce rate goes to roughly everyone.

What else stops:

• Apps and API clients fail outright. There is no "proceed anyway" button in a mobile app or a webhook.
• Embedded widgets stop loading: payment iframes, chat widgets, analytics, fonts.
• Search crawlers treat the site as unreachable, so pages can drop out of the index if it drags on.
• Anything on a schedule that talks to your domain, including mail delivery over TLS, breaks quietly.

In December 2018 an expired certificate inside Ericsson software took mobile data offline for tens of millions of O2 and SoftBank customers for a day. It happens to large companies with paid certificates, because a human sits in the renewal loop.

Automation is the fix. Not a more expensive certificate.

When Buying One Is Actually The Right Call

I would pay in these cases and only these:

1. A compliance or procurement rule names OV or EV. Some finance, health and government contracts specify it, and arguing with a checklist wastes your week.
2. You need a wildcard and your host cannot do DNS validation. Covered above, and it is a real constraint.
3. The certificate is not for a website. Code signing, S/MIME email certificates and document signing are separate products, and none come free from a public authority.
4. You need names a public authority cannot issue, such as an internal hostname or a private network device. That is a private CA, not a purchase.
5. Very old client devices with trust stores nobody ever updated. Rare now, but payment terminals and ancient Android builds still exist.

None of those are "my site takes credit cards" or "I want customers to trust me". A checkout page on a free DV certificate is exactly as encrypted as one on a $400 EV certificate.

Our own limit, stated plainly: OxyPages issues a free DV certificate for every site and does not accept one you bought elsewhere. If your compliance team requires OV or EV with your registered name inside it, we are the wrong host.

What To Do Next

Five minutes, in this order.

1. Open your site, click the icon to the left of the address bar, and follow it through to the certificate details.
2. Look at Issued By and Valid Until. If it says Let's Encrypt, Google Trust Services, Cloudflare or Amazon, your host is already handling this. Close the checkout tab.
3. If there is no certificate at all, that is a hosting problem rather than a shopping problem. Getting the page online properly usually fixes it, because the certificate arrives with the host.
4. If a rule genuinely names OV or EV, buy it, then diary the renewal with a reminder two weeks early.
5. Either way, confirm that renewal is automatic. That is the whole job.

Your SSL certificate cost is the smallest number in this decision. Where the site lives, and whether renewal happens without you, matter more.

If you are still choosing a host, pick one that treats HTTPS as part of the service instead of an upsell. What comes included at no charge sets out what that looks like, and publish a folder on OxyPages with HTTPS already on is the two-minute version.