An SSL certificate does two things and no more: it encrypts what travels between your visitor's browser and your server, and it proves the domain they are visiting is the one they asked for. It does not make your site secure, does not protect it from being hacked, and does not stop a weak password from leaking.
Three levels of validation, not three levels of encryption
The first thing to unlearn: the encryption is identical across all types. A free certificate and one costing hundreds of dollars use the same algorithms. The difference is what the issuer verifies before granting it.
- DV (domain validation): proves you control the domain. Issued automatically within minutes — this is what you get for free.
- OV (organisation validation): the issuer checks that your company legally exists, and its name appears in the certificate details.
- EV (extended validation): a stricter audit of the legal entity. It used to show a green bar with the company name; browsers removed that display years ago.
When is free enough?
It is enough for brochure sites, blogs, and small stores that hand payment to an external gateway. It renews automatically every 90 days, and that short cycle is a feature, not a flaw: it forces automation you cannot forget, instead of a yearly certificate that expires suddenly over a holiday.
When does a paid one earn its price?
- When you need a written financial warranty from the issuer — some enterprise contracts require it.
- When you need one certificate covering several different domains, or deeper subdomain levels.
- When a client or regulator requires your company name to appear in the certificate.
Common mistakes
- 01Installing without the intermediate chain: it works in your browser and fails on other devices — test from a device you have never used.
- 02Forgetting renewal: set a reminder at least two weeks ahead, or automate it.
- 03Leaving internal links on http: the browser complains about mixed content and blocks part of the page.
- 04Not redirecting http to https: the certificate exists but nobody passes through it.
In short: start with an automated free DV certificate. Pay only when a contract or a specific technical need asks for something it does not provide — not because the expensive one feels safer.
Read next
- HostingThe backup that actually works when you need itThe 3-2-1 rule, why an untested backup is not a backup, and what everyone forgets until they lose it.
- DomainsTest2Test3 Test4 Test4 vTest4Test4Test4Test4Test4Test4Test4
- WebWebsite speed: what Google actually measures and how to fix itThree metrics that decide your visitor's experience, their most common causes — and why images explain most of them.