SSL certificates for site owners: what you're actually buying

SSL certificates for site owners: what you're actually buying

When setting up a website, securing it with an SSL certificate is crucial. This document explains what SSL certificates are, their pricing landscape, and what site owners need to do.

What Does a Certificate Do?

An SSL (Secure Sockets Layer) certificate ensures that traffic to your domain is encrypted and that the server answering is legitimately associated with the domain. Without a certificate, browsers display "not secure" warnings, which can scare away visitors. This aspect of SSL certificates is non-negotiable and typically free.

Pricing Landscape

Free Certificates

• Let's Encrypt: Provides full encryption, identical to paid certificates. Issued by modern hosts or CDNs with a simple checkbox setup (e.g., Cloudflare). Our stack uses Cloudflare to terminate TLS at the edge, requiring no certificate management.
• Bundled by Cloudflare/Hosts/Builders: These providers offer free SSL certificates that are easy to set up and manage.

Paid DV Certificates

• Price Range: $10-$100/year from resellers
• What You Get: Cryptographically identical protection to the free options. The primary benefit is a guaranteed renewal process, which requires you to remember to renew the certificate manually.
• Use Case: This option may be required by corporate policies.

OV/EV Certificates

• Price Range: $100-$1000/year
• What You Get: These certificates verify the company's legal identity. While browsers used to show a green bar for EV certificates, this feature was removed years ago. The remaining use cases are primarily for enterprise or compliance purposes.
• Marketing Value: For small businesses, these certificates may be marketed as enhancing trust and security, but their actual value is minimal.

Wildcard Certificates

• Price Range: Free via Let's Encrypt with DNS validation
• What You Get: One certificate that covers all subdomains. This is particularly useful for sites with many subdomains.
• Setup: Using DNS validation makes it easy to manage multiple subdomains under a single SSL certificate.

What Site Owners Need to Do

1. Ensure HTTPS Works and HTTP Redirects to It: Make sure your site uses HTTPS and that all HTTP traffic redirects to HTTPS.
2. Ensure Auto-Renewal is Happening: Monitor the expiration of your SSL certificates, as manual renewals can lead to outages (e.g., a manually installed certificate expiring after one year).
3. Confirm Free SSL is Included in Hosting Plans: Verify that your hosting provider offers free SSL certificates. If they charge extra for basic SSL, this may indicate a broader pricing philosophy.

Recognizing the Upsell

• "Premium SSL for Better Security": This upsell typically refers to paid DV certificates and does not offer any additional security benefits.
• "SSL Improves Your SEO Ranking": While HTTPS is important for SEO, paid SSL certificates do not provide any additional ranking benefits beyond free ones.
• "Site Seal Increases Trust": This often refers to a marketing image that has no real impact on user trust.

The padlock icon provided by free SSL certificates is the standard and essential feature. Paid SSL certificates are primarily about ensuring automatic renewals and providing a sense of corporate compliance, but they do not offer any additional security or SEO benefits beyond what free options provide.