SSL Certificate: Free vs Paid, Setup and Renewal Guide

An SSL certificate is the file that lets a browser connect to your website over HTTPS. Without a valid one, Chrome shows a “Not secure” warning, form data travels unencrypted and many visitors simply leave. Most guides still treat it as something you buy once and forget. That stopped being true in 2026.

Certificates now expire faster than they used to, and the free ones expire fastest. So the real question is no longer “which SSL certificate should I buy”. It is “who renews it, and how will I know if renewal fails”. This guide covers both.

What an SSL certificate does

An SSL certificate does two jobs. It encrypts the connection between the visitor’s browser and your server, and it proves the site really belongs to the domain in the address bar.

A small technical note: SSL stands for Secure Sockets Layer, which was replaced years ago by TLS (Transport Layer Security). The name stuck, so people still say SSL certificate when they mean a TLS certificate. Hosts, registrars and search results all use the old name, so this article does too.

For rankings, HTTPS is a light signal and will not carry a weak page. The bigger effect is trust. A browser warning on a checkout or contact page costs you real inquiries, and a site that lost its certificate overnight often shows it in analytics as a sudden traffic drop.

Validity is getting shorter: what changed in 2026

For years a certificate could last 398 days. Since 15 March 2026, publicly trusted certificates are capped at 200 days. The limit drops to 100 days on 15 March 2027 and to 47 days in 2029, under a CA/Browser Forum ballot that SSL.com explains in detail.

Here is what that means in practice:

• A “one year” paid SSL certificate now means roughly two certificates a year, because each file is issued for under 200 days. The provider normally reissues it under the same annual license, but someone still has to install the new file unless your host automates it.
• In 2027 that becomes about four installs a year.
• Free certificates from Let’s Encrypt already run on 90 days and are designed around automatic renewal.

The sensible conclusion is not to avoid paid SSL. It is to stop treating installation as a manual yearly task.

SSL certificate free vs paid

A free SSL certificate, mostly from Let’s Encrypt, gives the same browser padlock and the same encryption as a paid one. For most business websites, blogs and online stores, that is enough.

Paid certificates make sense in narrower cases:

• You want a warranty or dedicated support from the certificate authority.
• You need an organization validated (OV) or extended validation (EV) certificate for contractual or compliance reasons.
• Your host does not support automatic renewal and you prefer a reseller who handles issuance for you.
• You run an unusual setup, such as a certificate shared across servers.

One point that surprises many buyers: EV used to put the company name in a green bar. Modern browsers dropped that display years ago, so an EV certificate no longer looks different to visitors. If someone is selling you EV because it “looks more trustworthy”, ask what the visitor actually sees.

DV, OV and EV in plain terms

Type	What is checked	Issue time	Typical use
DV (domain validated)	You control the domain	Minutes	Most websites and stores
OV (organization validated)	Domain plus the registered business	Days	Companies that need verified details in the certificate
EV (extended validation)	Deeper business checks	Days or longer	Compliance driven cases

Wildcard certificates cover one level of subdomains, such as shop.yourbrand.com and blog.yourbrand.com. Check whether the base domain is included before you buy. Multi-domain certificates cover several separate domains under one file. Let’s Encrypt issues wildcards too, but it requires DNS based validation, which is more setup than a normal certificate.

How to check an SSL certificate

SSL certificate checks take a minute and are worth doing every month. There are three ways, from simplest to most thorough.

1. Browser: click the padlock next to the address bar and open the certificate details. Look at the expiry date and the domain names it covers.
2. Online test: run your domain through SSL Labs. It reports the chain, expiry date, supported protocols and common configuration errors.
3. Command line: if you have terminal access, this prints the validity dates directly:

echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -dates

Check both the www and non-www versions. A certificate that covers only one of them is a common reason for sudden errors.

How to get and install an SSL certificate

The right path depends on where your site is hosted.

On shared hosting with cPanel. Most hosts run AutoSSL, which issues and renews a free certificate for every domain on the account. Open the SSL/TLS Status page in cPanel, run AutoSSL and confirm each domain shows a valid certificate. If a domain fails, the usual cause is DNS pointing somewhere else, so the host cannot prove you control it. If you are still choosing a host, our web hosting guide for Pakistan explains what to look for.

With a paid certificate. You generate a CSR (certificate signing request) on your server, usually in cPanel under SSL/TLS, and submit it to the provider. The CSR holds your domain name and public key. The matching private key, the “SSL key” many people search for, stays on your server and should never be emailed or pasted into a chat. The provider validates your domain, then sends the certificate file and a chain bundle that you paste into the install screen.

On WordPress. Install the certificate at the hosting level first, then switch the site URLs to HTTPS in Settings, General. A plugin that only forces HTTPS does not replace a real certificate.

If you moved to a new host recently, remember the old certificate does not transfer automatically. Issue a new one on the new server, and keep your domain settings under your own control so the switch is painless.

Moving from HTTP to HTTPS without losing rankings

Installing the certificate is half the job. Finish the migration in this order:

1. Redirect every HTTP URL to its HTTPS version with a 301.
2. Update canonical tags, internal links and your XML sitemap to HTTPS.
3. Fix mixed content, where an HTTPS page still loads an image, script or font over HTTP. This is what breaks the padlock on pages that otherwise look fine.
4. Use a Domain property in Google Search Console so HTTP and HTTPS data stays together.
5. Turn on HSTS only after everything works, because it tells browsers to refuse HTTP for your domain.

SSL certificate errors and what causes them

Browser message	Usual cause	Fix
NET::ERR_CERT_DATE_INVALID	Certificate expired, or the visitor’s device clock is wrong	Renew and install the certificate. Ask the visitor to check the date on their device
ERR_CERT_COMMON_NAME_INVALID	Certificate does not cover the domain or the www version	Reissue it with both names
NET::ERR_CERT_AUTHORITY_INVALID	Missing intermediate certificate or a self-signed file	Install the full chain bundle from the provider
Not secure despite a valid certificate	Mixed content on the page	Change HTTP resource links to HTTPS

If only some visitors see an error, suspect their device date or an old browser before blaming your server.

Why SSL renewals fail (and how to catch them)

This is the part most competitors skip. Automatic renewal works until something changes underneath it.

Common causes are a DNS change that stops domain validation, a hosting migration that leaves the old renewal job behind, an expired payment method on a paid plan and a redirect rule that blocks the validation file. On top of that, Let’s Encrypt stopped sending expiry reminder emails on 4 June 2025 and now points people to third party monitoring tools. So a silent failure really is silent.

A simple routine covers it:

• Put a calendar reminder 20 days before every expiry date.
• Run an SSL check as part of your monthly website maintenance.
• Set up uptime monitoring that also checks the certificate, so you get an alert before visitors do.
• Keep the admin login for your hosting and domain somewhere your whole team can reach, because an expired certificate at 11 pm is not the moment to look for a password.

Since a compromised site can also have its certificate or configuration tampered with, pair this with the basics in our WordPress security guide.

SSL certificate FAQs

Q1. What does SSL certificate stand for?

Secure Sockets Layer. The technology is now TLS, but the certificate is still called SSL.

Q2. Is a free SSL certificate good enough?

For most websites, yes. It encrypts traffic the same way as a paid one. You pay for warranty, support and higher validation levels.

Q3. How long does a Let’s Encrypt certificate last?

90 days, and tools renew it automatically in the background, usually about 30 days before expiry.

Q4. How long does it take to get an SSL certificate?

A DV certificate often issues within minutes. OV and EV take longer because the business is checked.

Q5. Why does my site say Not secure after installing SSL?

Usually mixed content or a missing redirect. Check the page source for http:// links.

Q6. Can one SSL certificate cover multiple domains or subdomains?

Yes. A wildcard covers subdomains of one domain and a multi-domain certificate covers several domains.

Q7. What is a CSR?

A certificate signing request. It is a block of text generated on your server that contains your domain and public key, and you submit it when ordering a certificate.

Q8. How do I verify an SSL certificate is valid?

Check the padlock details in your browser, or run the domain through SSL Labs for a full report.