SSL Certificates Explained: Types, Costs, and How to Get One Free

What is an SSL Certificate?

An SSL (Secure Sockets Layer) certificate is a digital document that binds a cryptographic public key to the identity of a website. Despite the name, modern certificates actually use TLS (Transport Layer Security) — SSL was deprecated in 2015 — but the term "SSL certificate" persists in common usage.

The certificate contains: the domain name(s) it is issued for, the certificate owner's information, the public key, the issuing Certificate Authority (CA), the digital signature of the CA, and the validity period. When your browser connects to an HTTPS website, it reads this certificate to verify it is talking to the legitimate owner of that domain.

The entire system depends on a network of trusted Certificate Authorities — organisations like DigiCert, Sectigo, GlobalSign, and the non-profit Let's Encrypt — whose root certificates are pre-installed in operating systems and browsers. When a CA signs a certificate, any browser that trusts that CA will also trust the signed certificate.

How Certificates Work

The certificate verification process during a TLS handshake works as follows:

1. Your browser connects to the server and requests its certificate.
2. The server presents its certificate, which contains its public key and the CA's digital signature.
3. Your browser verifies the CA's signature using the CA's public key (which is baked into your browser/OS).
4. Your browser checks that the certificate is not expired and has not been revoked (via OCSP or CRL).
5. Your browser verifies the domain in the certificate matches the domain you navigated to.
6. If all checks pass, the connection proceeds with encryption. If any check fails, a warning is shown.

This chain of trust — from the root CA through any intermediate CAs to the end-entity certificate — is called the certificate chain. Servers must send the full chain (not just the leaf certificate) for browsers to verify it correctly.

DV, OV, and EV Certificates

Certificates are classified by the level of identity verification the CA performs before issuance:

Domain Validated (DV)

The CA verifies only that the applicant controls the domain. This is done automatically via email, HTTP file challenge, or DNS TXT record. Issuance takes minutes. DV certificates are free from Let's Encrypt and cost $0–$100/year from commercial CAs.

Encryption strength is identical to OV and EV. The only difference is what identity information is embedded in the certificate — DV certificates contain no organisation details.

Organization Validated (OV)

The CA verifies the applicant's legal organisation identity through business registration documents, phone verification, and other checks. The organisation's name is embedded in the certificate. This process takes hours to a few days and costs $50–$300/year.

OV certificates are appropriate for businesses that want to provide additional assurance to technically sophisticated users who inspect certificate details.

Extended Validation (EV)

EV requires the most rigorous vetting: legal existence, physical address, phone number, and authorised signatory verification. Historically, browsers showed the organisation's name in a green address bar for EV certificates. In 2019, Chrome and Firefox removed this visual distinction, making EV certificates largely indistinguishable from OV in the browser UI. EV certificates cost $150–$1,000+/year.

Single Domain, Wildcard, and Multi-Domain

Type	Covers	Example	Typical Cost
Single Domain	One FQDN	www.example.com	Free–$100/yr
Wildcard	Domain + all subdomains	*.example.com	Free–$300/yr
Multi-Domain (SAN)	Multiple specific domains	example.com, example.net	$50–$500/yr

A wildcard certificate uses an asterisk as the first label of the domain name. It covers all first-level subdomains — www, blog, shop, api — but not second-level ones like mail.blog.example.com. Let's Encrypt offers free wildcard certificates via the DNS-01 challenge.

How Much Do Certificates Cost?

The range is enormous: from free (Let's Encrypt, ZeroSSL) to thousands of dollars per year for commercial EV certificates. The price difference does not reflect encryption quality — it reflects the CA's business model and the level of identity verification provided.

For most use cases, the cost should be $0. Hosting providers like Cloudflare, AWS Certificate Manager, and most modern web hosts provide free certificates automatically. The notion that a "real" website needs a paid certificate is a myth perpetuated by commercial CAs with a financial interest in maintaining it.

Getting a Free Certificate with Let's Encrypt

Let's Encrypt is a free, automated, open CA run by the non-profit Internet Security Research Group (ISRG). It has issued over three billion certificates since launching in 2016 and is trusted by all major browsers.

The ACME (Automatic Certificate Management Environment) protocol automates the entire issuance process. The standard tool for interacting with Let's Encrypt is Certbot. On a typical Ubuntu/Nginx server:

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com

Certbot handles domain verification, certificate issuance, server configuration, and automatic renewal. Certificates are valid for 90 days; Certbot renews them automatically at around 60 days.

Installing Your Certificate

If you are installing manually (without Certbot), you will need three files: the certificate itself (.crt), the private key (.key), and the CA bundle (intermediate certificates). A typical Nginx configuration:

server {
    listen 443 ssl;
    ssl_certificate /etc/ssl/example.com.crt;
    ssl_certificate_key /etc/ssl/example.com.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
}

After installation, verify your configuration with an SSL checker to confirm the full chain is served correctly and that no deprecated TLS versions or weak ciphers are enabled.

Certificate Renewal and Automation

Certificate expiry is one of the most common causes of website outages. An expired certificate causes browsers to display a hard block warning that most users will not bypass, effectively taking your site offline.

Best practices for renewal:

• Use automated renewal (Certbot, ACME clients) — never rely on manual renewal.
• Set up monitoring alerts for certificates expiring within 30 days.
• Test your renewal process before the certificate actually expires.
• For short-validity certificates (90 days), automate renewal to trigger at 60 days.