Which free CA is best?

Let's Encrypt for most people: no account, the largest community and support in nearly every hosting panel. Add ZeroSSL or Google Trust Services as a backup CA.

Can I use two CAs at the same time?

Yes. Many ACME clients can fall back to a second CA if the first fails. Allow both in your CAA records, for example 0 issue "letsencrypt.org" and 0 issue "pki.goog".

Are the certificates any different for visitors?

No. All three are DV certificates trusted by the major browsers; only the issuer name differs.

Let's Encrypt vs ZeroSSL vs Google Trust Services (2026)

For most sites Let's Encrypt is the default choice: it needs no account, works with almost every hosting panel and ACME client, and is trusted everywhere. ZeroSSL makes a good second CA if your client supports External Account Binding, and Google Trust Services suits teams on Google Cloud. All three issue free DV certificates, including wildcards via DNS-01.

At a glance

Let's Encrypt is the only one of the three that needs no account. Comparison as of November 2026:

	Let's Encrypt	ZeroSSL	Google Trust Services
Price	Free	Free over ACME; paid plans for web UI	Free
Account needed	No	Yes, EAB credentials	Yes, Google Cloud project + EAB key
Default lifetime	90 days (64 days from 10 Feb 2027)	90 days	See Google Cloud docs
Shorter options	45-day `tlsserver`, 160-hour `shortlived` profiles	—	—
Wildcards	Yes (DNS-01)	Yes	Yes
CAA value	`letsencrypt.org`	see ZeroSSL docs	`pki.goog`
Web interface	No	Yes (free plan: 3 certificates)	No (gcloud CLI)

Let's Encrypt

Let's Encrypt is the simplest: point certbot, acme.sh, Caddy or your control panel at it and certificates renew on their own. It is also the CA moving fastest towards short lifetimes. Its classic profile issues 90-day certificates, the tlsserver profile 45-day ones, and the opt-in shortlived profile certificates valid for 160 hours. The default drops to 64 days on 10 February 2027 and to 45 days in 2028, so make sure your client renews based on the certificate's lifetime (or ARI), not a fixed 60-day timer.

ZeroSSL

ZeroSSL issues an unlimited number of free 90-day certificates over ACME at https://acme.zerossl.com/v2/DV90, but your client must register with External Account Binding (EAB) credentials from your ZeroSSL account; acme.sh can create them from an email address. Its web interface is handy if you cannot run ACME at all, but the free plan there is limited to 3 certificates. ZeroSSL's certificates chain to Sectigo roots, so a ZeroSSL backup does not share Let's Encrypt's chain.

Google Trust Services

Google's free public CA is reached through Google Cloud Certificate Manager. You enable the Public CA API in a Google Cloud project, create an EAB key with gcloud publicca external-account-keys create, and register your ACME client with it. It suits teams that already manage infrastructure on Google Cloud; for a single small site the set-up is heavier than Let's Encrypt.

Recommended setup

Run Let's Encrypt as the primary CA and one of the others as a fallback:

Use Let's Encrypt as your primary CA.
Add ZeroSSL or Google Trust Services as a fallback in your ACME client.
Publish CAA records allowing both CAs. Check them with the CAA checker or generate them with the CAA generator.
Monitor expiry so a failed renewal does not reach visitors; see automating certificate renewal.

If you need OV, EV or a vendor to support you, none of these will do; see free vs paid SSL.

This page contains affiliate links. We may earn a commission at no extra cost to you. Learn more

Let's Encrypt vs ZeroSSL vs Google Trust Services