SSL for small businesses: a practical plan

Most small businesses need one thing: a free DV certificate that renews itself. cPanel (AutoSSL), Plesk and many managed WordPress hosts issue one automatically, and certbot or acme.sh does the same on your own server. Pay only when a customer, bank or tender asks for your company name in the certificate (OV), or your host cannot install free certificates.

Step 1: check what your host already does

Check before buying: your host may already provide a free certificate. Open your site with https:// and run the SSL checker. If the certificate is valid and issued by Let's Encrypt, ZeroSSL, Google Trust Services or your host's CA, and the panel says it renews automatically, you are done. Many small-business sites pay for a certificate they do not need because a web designer bought one years ago.

Step 2: decide whether you need OV

You need OV only if someone outside your business checks the certificate's organization field:

• a public-sector or enterprise tender that requires an "organization-validated certificate";
• a bank, insurer or payment partner that specifies OV or EV;
• a business customer whose security questionnaire asks for it.

If so, OV costs little when you compare sellers: Sectigo InstantSSL was $32.80 and Namecheap High Assurance SSL $35.99 for the first year on 10 November 2026. Expect 1 to 3 business days and have your registration documents ready. EV is rarely worth it; see is EV SSL worth it?.

Step 3: if your host cannot install free certificates

Buy a cheap DV certificate, or better, move to a host that supports automatic certificates. Some older shared hosts only accept uploaded certificates; a paid DV certificate then saves you from manual Let's Encrypt renewals every few weeks. Good low-cost choices were Namecheap Standard SSL at $11.00 and PositiveSSL at $16.00 for a year. Since 15 March 2026 even paid certificates last at most 200 days, so you will still install a new one at least twice a year.

Running your own VPS

On your own VPS, free certificates cost nothing to obtain and renew. A VPS from providers such as RackNerd, Vultr, DMIT or BandwagonHost gives you control of the server, so you can use certbot directly:

# Nginx on Debian/Ubuntu with certbot
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com

Certbot installs a timer that renews certificates before they expire. Test the renewal path once with sudo certbot renew --dry-run.

Step 4: make sure it never expires

An expired certificate takes your site offline for visitors with a full-page browser warning. Whatever you choose:

• confirm renewal is automatic, or put the expiry date in a calendar with a reminder 30 days before;
• add the site to certificate monitoring so you hear about a failed renewal before customers do;
• after any hosting or DNS change, run the SSL checker again.