# Free vs paid SSL certificates: what you get for the money

> Free ACME and paid DV certificates encrypt the same way. What paying adds (identity, a warranty, vendor support) and when it is worth it in 2026.

Source: https://ssl.sh/compare/free-vs-paid-ssl/
Last updated: 2026-11-10

For most websites a **free certificate is the better choice**: Let's Encrypt, ZeroSSL and Google Trust Services issue browser-trusted DV certificates that renew automatically, with the same encryption as paid ones. Pay for what free CAs do not issue (OV/EV identity, code signing, a VMC logo), for a warranty or vendor support, or when your host cannot run ACME.

## What is identical

Encryption is identical. Free and paid DV certificates use the same key types (RSA or ECDSA), chain to roots in the same browser root stores, and show the same padlock. A visitor cannot tell them apart without reading the issuer name.

## What paying adds

Paying adds identity checks, a warranty, vendor support and a site seal, not stronger encryption.

| | Free (ACME) | Paid DV | Paid OV/EV |
|---|---|---|---|
| Browser trust | Yes | Yes | Yes |
| Organization name in certificate | No | No | Yes |
| Wildcard | Yes, via DNS-01 | Yes | OV yes, EV no |
| Warranty | None | Typically $10,000–$500,000 | Up to $1,750,000 |
| Support | Community forums | Seller and CA support | Seller and CA support |
| Site seal | No | Usually | Usually |
| Typical 1-year price | $0 | From [$11.00](https://ssl.sh/certificates/namecheap-standard-ssl/) | From [$32.80](https://ssl.sh/certificates/instantssl/) |

Warranties pay the relying party (your visitor), not you, and only if the CA mis-issues a certificate; they are rarely claimed. Treat them as a sign of the CA's confidence, not as insurance for your business.

## The 200-day rule removed paid certificates' biggest advantage

Under the 200-day cap a paid certificate needs reissuing as often as a free one. Paid certificates used to last a year or more, which meant fewer manual renewals. Since 15 March 2026 the CA/Browser Forum caps every public TLS certificate at 200 days, then 100 days from 15 March 2027 and 47 days from 15 March 2029. A paid "1-year" or "5-year" purchase is now a subscription during which you reissue and install the certificate repeatedly. If you have to automate anyway, free ACME certificates are the simpler path. Read [multi-year SSL after the 200-day limit](https://ssl.sh/compare/multi-year-ssl-after-200-days/).

Free certificates are getting shorter too: Let's Encrypt moves its default from 90 to 64 days on 10 February 2027 and to 45 days in 2028.

## When to pay

Pay in four situations:

- **You need identity.** OV or EV for tenders, B2B partners or policies; see [DV vs OV vs EV](https://ssl.sh/compare/dv-vs-ov-vs-ev/).
- **Your host cannot automate.** Some shared hosts and appliances only accept uploaded certificates; a paid certificate with a seller who reminds you and reissues for free is easier to manage there.
- **You want a vendor to call.** Paid sellers provide support with CSR generation, installation and validation.
- **It is not a TLS certificate.** Code signing, organization S/MIME, document signing and VMC are paid-only.

## When free is enough

Blogs, SaaS apps, APIs, e-commerce on your own server, staging environments and internal tools exposed to the internet all work fine with free ACME certificates. Compare the three main free CAs in [Let's Encrypt vs ZeroSSL vs Google Trust Services](https://ssl.sh/compare/lets-encrypt-vs-zerossl-vs-google-trust-services/), and use the [SSL checker](https://ssl.sh/tools/ssl-checker/) after setup.