Bridge SSL
SSL certificate price: what you pay for, and when it is $0
An SSL certificate can cost nothing. Let's Encrypt does not charge a fee for its certificates [1], and the Baseline Requirements give every type of certificate the same assurance about the domain name [3]. When an SSL certificate has a price, the money pays for checks on the organisation, for the names covered and for support, not for stronger encryption. Prices of paid certificates differ between sellers and change, so none are quoted here [7]; this page shows what each part of a price buys and how to count your own cost. Which authority to use is a separate question, answered in how to choose a certificate authority.
- Lowest price
- $0: Let's Encrypt does not charge a fee for its certificates [1]
- Encryption
- negotiated by client and server in the TLS handshake, whatever the certificate cost [4]
- Longest validity
- 200 days for certificates issued from 15 March 2026, paid or free [3]
- Warranties
- the Baseline Requirements warranties come with every TLS server certificate a publicly trusted CA issues [3]
- On Bridge CDN
- included with the account, with no per-certificate charge [7]
What the price of an SSL certificate pays for
The price of an SSL certificate pays for work done around the certificate. All four certificate types share one profile and differ only in the subject fields, how those are validated and the policy identifiers [3]. Encryption is not among the differences: the TLS handshake negotiates the cryptographic parameters between client and server [4]. When two offers differ in price, compare them line by line:
| What you pay for | What the authority does | When you need it |
|---|---|---|
| Domain validation | checks control of each name [3]; Let's Encrypt automates it and charges nothing [1] | every certificate |
| Organisation validation (OV) | verifies the organisation's identity and address, for example through a government agency, a third-party database or a site visit [3]; Let's Encrypt offers neither OV nor EV, primarily because it cannot automate issuance for them [1] | a policy or a contract names OV or EV |
| More names | lists each name in the subject alternative name extension [5]; a wildcard such as *.example.com matches one label [6] | the site answers on more than one name |
| Support | answers when issuance or revocation goes wrong; Let's Encrypt offers documentation and forums, not direct support [1] | a failure must go to someone under contract |
| A warranty amount | terms in the authority's own policy documents; beyond them, a CA that followed the requirements may disclaim liability [3] | a contract asks for one |
The cost that is not on the price list
The cost of SSL certificates that a price list leaves out is renewal: the work of replacing each certificate before it expires. The Baseline Requirements cap the validity of every publicly trusted TLS server certificate, paid or free, and the cap is shrinking [3]:
| Certificate issued | Maximum validity | Domain validation reused for at most | Certificates a year for one name, at least |
|---|---|---|---|
| from 15 March 2026 | 200 days | 200 days | 2 |
| from 15 March 2027 | 100 days | 100 days | 4 |
| from 15 March 2029 | 47 days | 10 days | 8 |
The last column is arithmetic: 365 days divided by the maximum validity, rounded up. A plan that runs longer than the cap therefore arrives as several certificates, each requested and installed in turn. On a manual route each replacement repeats the installation: request, bundle, configuration and reload [7].
Organisation checks age more slowly than domain checks. Identity data behind an OV certificate may be reused for up to 398 days [3], so the manual check behind it has to be redone at least every 398 days. For certificates issued from 15 March 2029, proof of domain control may be reused for 10 days [3]: a certificate requested later than that needs a new domain check, which is why the domain check is the part to automate.
Count the cost for your own names
Take a site that answers on example.com, www.example.com, api.example.com, shop.example.com and eu.shop.example.com:
List every name the site answers on, the bare domain and
wwwincluded. A client checks the name it connects to against the names in the certificate [6].Choose how to cover them. One certificate can list all five names in its subject alternative name extension [5][1]. A wildcard
*.example.comcoverswww,apiandshop, and notexample.comitself oreu.shop.example.com, because a wildcard matches exactly one label [6]. Those two are added next to the wildcard.Check whether anything requires OV or EV. If no policy or contract names a validation level, domain validation is enough, and it is the type Let's Encrypt issues [1].
Count the replacements. At the maximum validity, one name served all year needs at least 2 certificates a year now, 4 from 2027 and 8 from 2029. Note who does each one: a person, an ACME client or the platform that serves the site.
Ask what the host charges. Let's Encrypt notes that some integrators, such as hosting providers, charge a nominal fee for providing its certificates [1]. A free certificate can still show up on a hosting bill.
When $0 is the right answer
A certificate at $0 is the right answer when all of these hold:
No requirement names a validation level. Let's Encrypt issues domain-validated certificates only [1].
Every name can be validated automatically, by an ACME client on your server or by the platform that serves the site.
Documentation and community forums are enough when something fails [1].
If one of them does not hold, a paid certificate or a paid arrangement may fit better; the cases that call for one are set out in when you need a Let's Encrypt alternative. Paying no longer buys a long-lived certificate: the 200-day cap applies to paid certificates as well [3].
Let's Encrypt and ZeroSSL both issue certificates through ACME at no charge; ZeroSSL stores the certificates you create in your ZeroSSL account [1][2]. What still differs between them at the same price is covered in ZeroSSL compared with Let's Encrypt.
The price of an SSL certificate on Bridge CDN
On Bridge CDN the certificate is included with the account: no per-certificate charge and no renewal to buy [7]. Bridge SSL is the certificate layer of Bridge CDN and is not sold on its own, so "free" here means already paid for by the account you have. It covers a domain-validated certificate, and the *.example.com wildcard is included when the domain's DNS is on Bridge DNS [7]. Bridge SSL has no certificate upload, so an OV or EV certificate you have to keep cannot be installed here [7]. Current terms are on Bridge CDN, where signup lives.
FAQ
Is an expensive SSL certificate more secure?
Does a multi-year SSL plan give a multi-year certificate?
No. A certificate issued from 15 March 2026 can be valid for at most 200 days, paid or free, so a plan for a longer term is delivered as several certificates, and each one has to be installed. [3]
Does a $0 certificate come with a warranty?
Yes, with the Baseline Requirements warranties: by issuing a certificate, a publicly trusted CA warrants that it followed the requirements, including its procedure for checking the right to use the domain. A warranty amount on a price list is a separate term, set in the authority's own documents. [3]
Why does my host charge for a free certificate?
Let's Encrypt notes that some integrators, such as hosting providers, charge a nominal fee that reflects their administrative and management costs. The certificate itself is still issued without a fee. [1]
Sources
Let's Encrypt, FAQ: cost, validation types, multiple names (SAN), support, integrator fees.
ZeroSSL, ACME documentation: certificates at no charge through ACME, stored in the ZeroSSL account.
CA/Browser Forum, Baseline Requirements for TLS Server Certificates (version 2.3.1): §3.2.2.1 identity, §3.2.2.4 domain validation, §4.2.1 data reuse periods, §6.3.2 validity periods, §7.1.2.7.1 certificate types, §9.6.1 CA warranties, §9.8 limitations of liability.
RFC 8446, The Transport Layer Security (TLS) Protocol Version 1.3: §1.
RFC 5280, Internet X.509 Public Key Infrastructure Certificate and CRL Profile: §4.2.1.6 subject alternative name.
RFC 9525, Service Identity in TLS: §6.3, wildcard matching.
Bridge SSL, home page: What it costs; Four things this deliberately does not do; FAQ "Is the SSL certificate really free?" and "How is a wildcard authorised?".