Free SSL certificates: who issues them and what you give up

A free SSL certificate from a publicly trusted certificate authority is not a lesser certificate. The encryption is the same, browsers trust it the same way, and no visitor can tell what an SSL certificate cost. Free certificates are domain-validated only and come without a support contract, so the real requirement they bring is automated renewal. This page covers who issues them, how they differ from paid certificates, and when a free one is enough.

Issued by

Let's Encrypt, a nonprofit certificate authority ^[1], and commercial authorities that run a free tier next to paid plans

Issued through

ACME, the issuance protocol of RFC 8555 ^[2]

Validation

domain validation only; the certificate carries policy identifier 2.23.140.1.2.1 ^[3]

Assurance of the name

the same as a paid certificate: the Baseline Requirements say every certificate type provides "the same level of assurance of the device identity" ^[3]

Maximum lifetime

the same cap as paid certificates, 200 days for certificates issued from March 2026 ^[3]

Not included

organisation or extended validation, a support contract, warranty terms

Who issues free certificates

Free SSL/TLS certificates come from publicly trusted authorities that issue them through ACME, the standard protocol for automated issuance. Two kinds of certificate authority do it:

• Let's Encrypt, a nonprofit authority run by the Internet Security Research Group (ISRG). It charges no fee for its certificates and issues domain-validated certificates only; it has no plans for organisation or extended validation, because it cannot automate those checks. Wildcards are available through the DNS-01 challenge.

• Commercial authorities with a free tier. Some CAs that sell certificates also issue domain-validated ones through ACME at no charge, next to their paid plans; ZeroSSL is one example. What the free tier includes is set by each authority, so read its terms before you depend on it.

When something other than Let's Encrypt is warranted is on Let's Encrypt alternatives.

Hosting providers, control panels and CDNs can also obtain certificates for the sites they serve, without a separate step from you. Let's Encrypt notes that such integrators sometimes charge a nominal fee for providing its certificates, so a free certificate authority does not always mean a free certificate on your bill. Check what your platform does before installing anything.

How to get one

There are two routes, and the choice depends on where TLS ends for your site.

1. Your host or CDN issues it. If a platform terminates HTTPS for you, it can obtain and renew the certificate itself. You add the domain, point DNS at the platform, and the certificate follows. Nothing runs on your server.

2. An ACME client on your server. A program on the server proves control of the domain, receives the certificate, installs it and renews it before it expires. Choosing a client is a separate decision; installing the result is on installing a certificate.

For a wildcard such as *.example.com, control has to be proved through DNS. Among the ACME validation methods, the Baseline Requirements allow only the DNS-based ones for wildcard names (§3.2.2.4), so the client needs permission to create records in your zone. See wildcard certificates. The steps to generate an SSL certificate, from key to installed file, are a separate subject from whether to pay for one.

Free and paid certificates compared

What you get

• A publicly trusted certificate. It chains to a root present in browser trust stores, so it produces no warnings and nothing a visitor could see as different.

• Domain validation. The authority checks that you control the name, the same check behind paid domain-validated certificates. OV and EV add information about the organisation, not a stronger proof of the domain.

• Several names in one certificate. A free certificate can list several names through the Subject Alternative Name mechanism, and Let's Encrypt issues wildcards with DNS validation.

For a site that needs encryption and nothing about the organisation behind it, that is the whole requirement.

What you do not get

None of the differences is about security.

• Organisation or extended validation. A free certificate rests on domain validation: it proves control of the name and says nothing about who you are. To put an organisation into a certificate, the CA must verify the identity and address of that organisation (BR §3.2.2.1), and a free certificate authority skips that step. Where a compliance framework, a customer or a partner requires organisation details inside the certificate, a free certificate does not provide them.

• A support relationship. There is documentation and a community forum, but no one under contract to answer when something goes wrong.

• Warranty terms. A commercial CA can attach a warranty to a paid SSL certificate under its own terms. Whether it would ever pay out is a separate question; its absence is a real difference in what you hold.

Side by side

Lifetime and renewal

Every publicly trusted certificate, paid or free, has the same ceiling. The CA/Browser Forum ballot SC-081v3 limits every publicly trusted certificate to 200 days from March 2026, 100 days from March 2027 and 47 days from March 2029 (BR §6.3.2). An authority may issue for less; its documentation gives the term it uses.

Renewed by hand, a certificate needs attention more than once a year for every name, and the result of forgetting is a full-page browser warning for every visitor. That is why free issuance and automated renewal arrived together: in practice, a free certificate means automation.

Paid certificates are moving the same way. Buying a certificate no longer buys a long lifetime, and manual renewal becomes impractical whatever the price. How to renew and what to do when a certificate has expired is on renewal.

Why it costs nothing

A certificate is a signature over a small file, and producing it costs an authority very little. Paid certificates used to pay for the parts done by people: checking documents, calling the organisation, handling support, and selling. Automated domain validation removed people from the common case, because software can confirm control of a name directly. What remains is infrastructure, which is cheap per certificate at scale.

Let's Encrypt is funded by sponsors, grantmakers and individual donors, so the free certificate is the whole service, not a trial of a paid one. Commercial authorities run their free tier alongside paid plans, the more familiar commercial model. Neither changes the certificate itself.

When paying is the right call

A free SSL certificate is enough when the site needs HTTPS for its names and nothing about the organisation behind it. A paid certificate makes sense in three cases:

• A requirement names organisation validation. A compliance framework, a customer's procurement process, or an internal policy. The requirement is the reason; the certificate is how you meet it.

• You need someone answerable. Where certificate problems must be escalated to a party under contract, that relationship is bought. You are paying for a response obligation, not a better certificate.

• A device cannot be automated. Appliances that accept certificates only through a manual interface are easier to run with the longest lifetime available. With lifetimes shrinking for everyone, plan how such devices will be updated, because paying no longer avoids frequent replacement.

Outside those cases, arguments for paying that rest on security or trust describe something that does not differ.

How to tell what you have

A certificate records who issued it, what was checked and when it ends, and one command reads all three from a live site ^[4]:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -issuer -dates -ext certificatePolicies

• issuer names the authority, free or not.

• notAfter is the expiry date; the gap from notBefore is the lifetime the authority chose.

• Policy: 2.23.140.1.2.1 marks a domain-validated certificate; 2.23.140.1.2.2 is organisation validation and 2.23.140.1.1 extended validation ^[3]. The price appears nowhere.

What to check either way

The questions that matter are the same at any price. Does the certificate cover every name you serve, including the bare domain and www? Does renewal run automatically, and does something independent of the renewal check expiry from outside? Is the full chain served, intermediate CA certificates included, as described on certificate chains? A free certificate that is automated and monitored is better placed than a paid one renewed by hand whenever someone remembers.

FAQ

Sources

1. Let's Encrypt, About Let's Encrypt and FAQ: cost, validation types, wildcard issuance, support, integrator fees.

2. IETF, RFC 8555, Automatic Certificate Management Environment (ACME).

3. CA/Browser Forum, Baseline Requirements for TLS server certificates: §3.2.2.1, §3.2.2.4, §6.3.2, §7.1.2.7, §7.1.6.1; ballot SC-081v3.

4. OpenSSL, openssl-x509 manual page, options -issuer, -dates and -ext.