TLS certificates
Free where free is correct, paid where paid is
Every service here gets a certificate at no charge, issued and renewed automatically. The paid range exists for the three cases where an automatic certificate is not what you need, and this page says which three.
the price on the row above
Domain-validated, every service
90 d
Renewed automatically
3
Reasons to pay
1 d
Typical organisation validation
The range
| Certificate | Validates | Issued in | Names | Warranty | Per year |
|---|---|---|---|---|---|
| Domain validated | Control of the name | Minutes | One, plus www | None | 0.00 |
| Domain validated, wildcard | Control of the name | Minutes | All at one level | None | 0.00 |
| Organisation validated | The organisation exists | 1 to 3 days | Up to 100 | 1,000,000 | 96.00 |
| Extended validation | The organisation, in depth | 3 to 10 days | Up to 100 | 1,750,000 | 248.00 |
What it does, and what it does not
What a certificate does
- Encrypts the connection, so what is sent cannot be read in transit.
- Proves the connection reached the name in the address bar and not somewhere else.
- Lets the browser use HTTP/2 and HTTP/3, which it will not do without one.
- For an organisation-validated certificate, says who holds the name.
What it does not do
- It does not make the application behind it secure. A certificate is about the pipe, not what is in it.
- It does not stop a visitor being phished. An attacker can get a certificate for their own name in minutes.
- It does not improve search ranking in any way worth paying for.
- A more expensive certificate does not encrypt more strongly. The cipher is the same.
Questions we are asked
Then why would I pay for one?
Three reasons. A contract or an auditor requires organisation validation; you need one certificate covering many unrelated names with a warranty attached; or you are on a platform that cannot do automatic renewal and you want a long-lived file.
Is the free certificate less secure?
No. The encryption is identical. What differs is what was checked before it was issued, and for most sites what was checked is control of the name, which is all a browser cares about.
What happens when it expires?
Renewals are automatic, with a reminder thirty days ahead and again at seven.
Can I bring my own certificate?
Yes, on any service, and the private key stays where you put it.
Next step
You probably do not need to pay for this
Not sure which of these you are? Describe the workload and we will tell you.