The Legacy SSL Upsell Industry
During domain checkout, almost every legacy registrar presents a pop-up warning that your website will be "insecure" unless you purchase their $69.99/year SSL certificate. This is one of the highest-margin upsells in the entire web hosting industry.
The Reality: Let's Encrypt & Cloudflare Changed the World
Since 2016, Let's Encrypt, backed by the Electronic Frontier Foundation, Mozilla, Google, and Cisco, has issued billions of free, automated, Domain-Validated (DV) TLS certificates. They provide the identical 256-bit AES cryptographic encryption as any $100 commercial certificate.
Modern hosting providers (Vercel, Netlify, Cloudflare Pages, AWS, DigitalOcean) automatically provision and renew free SSL certificates on your behalf in seconds with zero configuration required.
What You Are Actually Being Sold
The upsell relies on a genuine ambiguity: certificates come in validation tiers, and vendors blur the distinction. There are three, and only one of them is free.
- Domain Validated (DV) proves control of the domain. Issued automatically in seconds. This is what Let's Encrypt provides free, and what the overwhelming majority of sites need.
- Organisation Validated (OV) adds verification of the legal entity. Requires manual review and carries a real cost.
- Extended Validation (EV) adds deeper legal vetting. Once displayed a green bar with the company name — browsers removed that treatment years ago, which removed most of the practical reason to buy it.
The critical point: the encryption is identical across all three. A free DV certificate and a $300 EV certificate negotiate the same TLS ciphers and provide the same protection in transit. What you pay extra for is identity assertion, not security — and since browsers stopped surfacing that identity, most visitors will never see the difference.
Why Free Certificates Are Not a Compromise
Let's Encrypt is operated by the Internet Security Research Group, a nonprofit backed by major browser and infrastructure organisations. Its certificates are trusted by every mainstream browser and operating system. It issues at a scale of hundreds of millions of active certificates.
Certificates are issued for 90 days, which sounds like a drawback and is actually the point. Short lifetimes force automation via the ACME protocol, and automated renewal is far more reliable than a calendar reminder to manually replace a certificate every two years. The single most common TLS outage — an expired certificate nobody remembered to renew — largely disappears once issuance is automated.
The industry has moved decisively in this direction; certificate lifetimes across the board are trending shorter, making automation mandatory rather than optional. A paid manual certificate is increasingly the fragile choice.
Where Automation Already Exists
If you host anywhere modern, this is solved and you need do nothing. Static hosts and platform providers provision and renew certificates automatically on domain connection. Reverse proxies and CDNs terminate TLS at the edge with managed certificates. On your own server, an ACME client obtains and renews certificates on a timer.
The only scenario requiring a purchased certificate is a specific compliance or contractual requirement for OV or EV assertion — a real but narrow case, and one that has nothing to do with the checkout pop-up warning that your site is "insecure".
When Paid Certificates Are Genuinely Warranted
- A contract or regulatory framework explicitly requires organisation validation.
- You need a wildcard or multi-domain certificate with support arrangements your platform does not provide — though free wildcards are available via DNS-based ACME validation.
- You require a warranty or liability guarantee from the issuing authority.
Note that none of these describe a personal site, a small business site, or a typical application.
Related Add-Ons Worth Declining
SSL is rarely the only pre-checked item at checkout. The same pattern applies to paid WHOIS privacy, which is free at every competitive registrar, and to bundled hosting offers where the real cost arrives in year two. A registrar's add-on strategy is usually a reliable indicator of its renewal pricing philosophy.
Frequently Asked Questions
Will visitors see a difference with a free certificate?
No. The padlock is identical. Browsers have not distinguished certificate tiers visually for years.
Does a paid certificate help SEO?
No. HTTPS is a lightweight ranking signal; the certificate's price and validation tier are irrelevant to it.
What happens if automated renewal fails?
The certificate expires and browsers show a warning. Monitor expiry as you would any other production dependency — automation reduces the risk substantially but does not eliminate the need to watch it.