Bridge SSL
Errors Certificates ACME Installation TLS Comparisons Tools Glossary All sections Comparison Bridge CDN network →
Bridge CDN →

Your SSL certificate costs nothing. Installing it is one button.

Certificates are included with Bridge CDN, for every domain and every subdomain you add, with no separate SSL plan and no per‑certificate charge. There is no signing request to generate, no file to upload, and no renewal date to put in anyone’s calendar: the layer that serves your site is the layer that issues the certificate.

Start on Bridge CDN See the installation

Wildcards included, and unlike a standard wildcard, fourth‑level names such as *.api.example.com are covered too.

Certificate price
Included
Steps to install
Add the domain
Wildcard depth
Fourth level

A certificate is a signature on a public key.
Charging for it is a business model, not a cost.

Issuing one costs a certificate authority almost nothing: it verifies you control the name, then signs. That is why the ACME protocol and free public authorities exist, and why the price of the same domain‑validated certificate ranges from nothing to several hundred dollars depending only on who sells it to you. What you are usually paying for is the paperwork around it, and the paperwork is exactly the part we removed.

What the money normally buys

  • A certificate signing request you generate and keep
  • A file bundle to download and put in the right place
  • An expiry date somebody has to remember
  • A second, separately priced certificate for each wildcard

What replaces it here

  • The platform holds the key; you never handle one
  • Nothing is downloaded, because nothing is installed
  • Renewal is the serving layer’s own job, not a calendar entry
  • Wildcards, including the fourth level, are part of the same account

Installing a certificate is nine steps and a recurring reminder.
Here it is one, and it does not come back.

Nothing below is unfair to the traditional route: it is the documented procedure every certificate authority publishes, and each step exists for a reason. The point is that all nine of them are handovers between you and the server, and a handover is the only place this can break.

The usual procedure 9 steps · then again before expiry
  1. 1 Generate a private key
  2. 2 Create a signing request
  3. 3 Buy the certificate
  4. 4 Prove you control the name
  5. 5 Download the bundle
  6. 6 Copy it onto the server
  7. 7 Assemble the chain
  8. 8 Edit the server config
  9. 9 Reload the service

Miss the repeat and every visitor sees a browser warning, at once, with no grace period.

Bridge SSL 1 step · no repeat
  1. 1 Add the domain

HTTPS is on. Issuing and renewing belong to the layer that already serves the site, so there is no handover left to fail.

The reason this is possible is boring and worth stating: the certificate never has to travel. It is used in the same place it is issued, which is why there is no bundle to move and no service to reload.

A wildcard covers exactly one label.
That is the rule the fourth level runs into.

*.example.com matches api.example.com, and it does not match eu.api.example.com. This is not a vendor limitation, it is how wildcard matching is defined: one asterisk, one label. Which means that the moment your names go one level deeper, the traditional answer is to buy a second wildcard certificate.

Every row below is a published fact,
taken from the other side’s own documentation.

No prices are quoted, because they change and because the structural difference is the point: what is one product here is two or three products elsewhere. Read the caveat under the table before you use any of this to make a decision: it matters, and leaving it out would make the comparison dishonest.

What you get Bridge SSL Cloudflare Universal SSL Commercial authorities
Certificate price Included with Bridge CDN Free on every plan Sold per certificate
Apex and third level
example.com, api.example.com		 Covered Covered Covered by a wildcard, sold separately
Fourth level
eu.api.example.com		 Covered, same account Not covered by Universal SSL — needs Total TLS or an Advanced Certificate Needs a second wildcard certificate
Installation Add the domain Automatic once the domain is proxied Yours: key, request, bundle, config, reload
Renewal The serving layer’s job Automatic Yours, before the expiry date
Certificate on your server None — nothing to install None — nothing to install Required

The caveat that belongs with that table. Cloudflare’s fourth‑level limitation applies to a full setup, where Cloudflare runs the domain’s nameservers. On a partial, CNAME‑based setup, each proxied hostname is issued its own certificate regardless of how deep it sits, so the depth limit does not apply there. If that is how you are set up, this row is not a difference between us.

Source: Cloudflare — Universal SSL. Commercial issuers referenced by their published product pages: DigiCert, GlobalSign, Sectigo, GoDaddy. Checked .

The exact string your visitor is reading.
Every one of them stops happening here.

Below are the five codes people paste into a search box most often, spelled the way the browser prints them. Each one has a cause, and every cause on this list is removed when the certificate is issued and served by the same layer: there is no expiry to miss, no chain to assemble wrong, and no name left uncertified.

Exact code Browser What the visitor sees On Bridge SSL
NET::ERR_CERT_AUTHORITY_INVALID Chrome, Edge Your connection is not private Removed
NET::ERR_CERT_DATE_INVALID Chrome, Edge Your connection is not private Removed
NET::ERR_CERT_COMMON_NAME_INVALID Chrome, Edge Your connection is not private Removed
SEC_ERROR_UNKNOWN_ISSUER Firefox Warning: Potential Security Risk Ahead Removed
ERR_SSL_VERSION_OR_CIPHER_MISMATCH Chrome, Edge This site can’t provide a secure connection Removed
The full error library Every code browsers print, what each one actually means, who can fix it, and a column saying whether Bridge SSL closes it, answered honestly one row at a time.

Three things this deliberately does not do.
Better said here than discovered later.

You cannot bring your own certificate

There is no upload. If you hold an existing certificate (an organisation‑validated or extended‑validation one, or one issued by an authority your company mandates), it cannot be installed here. The whole argument above rests on the platform owning the key, and owning the key means it has to issue its own.

You cannot choose the authority

The issuing authority is the platform’s decision, not a setting. If your compliance regime names a specific certificate authority, that requirement and this layer do not fit together.

There is no time commitment on issuing

Certificates are obtained on demand and renewed ahead of expiry, and we do not publish a guaranteed time for either. Keep an independent check on what your hostnames present: that recommendation does not change because renewal moved somewhere else.

What people ask first.

Is the SSL certificate really free?

It is included with a Bridge CDN account: there is no separate SSL plan, no per‑certificate charge, and no extra line for wildcards. Bridge SSL is not sold on its own, so “free” here means “already paid for by the account you have” rather than “free to anyone with no account”.

What does a fourth‑level wildcard actually cover?

A wildcard replaces exactly one label. *.example.com covers api.example.com but not eu.api.example.com, which needs *.api.example.com: a second wildcard, and normally a second purchase. Here it is part of the same account.

How is a wildcard authorised?

Through a DNS‑01 challenge, which is the only method by which a wildcard can be authorised at all. The platform places and removes the record; a wildcard is also warmed when the domain is added, so the first request does not wait on issuance.

What happens on my server?

Nothing. TLS is terminated at the edge, so there is no certificate file on your machine, no chain to assemble and no service to reload. That is also why the whole class of “renewed successfully but the server kept serving the old one” failures cannot occur.

Can I upload a certificate I already bought?

No. There is no import path, and none is planned as a setting. If an existing certificate has to be used, this layer is the wrong fit and it is better to know that now.

Do I still need to monitor certificates?

Yes, and the reason is worth understanding. A check that asks the renewing system whether renewal happened reports success right up until that system is the thing that failed. An outside check, asking what the hostname actually presents, shares nothing with the part that can break.

Everything above has a page behind it.
Eight sections, and what sits under each.

The landing argues; these explain. Each section below is a hub with its own pages underneath, written for the person who arrived from a search box with a specific error or a specific question rather than from an advertisement.

ACME 1 page

ACME lets software obtain and renew certificates without a person. See how the protocol works, what the challenges prove, and what…

TLS 1 page

Between clicking a link and seeing a padlock, two sides agree how to talk and one proves who it is. See the order of events and…

Add the domain.
The certificate is the part you stop thinking about.

Bridge SSL is the certificate layer of Bridge CDN, and signup lives there. Current terms, plans and everything else the account covers are on the same page.

Start on Bridge CDN Read the error library

No certificate to buy, nothing to install, and no renewal date to carry.