Is an SSL certificate free?

It can be. Let's Encrypt issues free, browser-trusted DV certificates, and most hosting companies and website platforms install and renew one for you at no charge. You pay only if you choose an OV or EV certificate, want vendor support or a warranty, or your setup cannot use automatic renewal. For a typical small business website, a free certificate is the sensible choice.

How long does an SSL certificate last?

Since 15 March 2026, publicly trusted certificates can last at most 200 days. That drops to 100 days in March 2027 and 47 days in March 2029. Let's Encrypt certificates last 90 days by default. Because lifetimes keep shrinking, certificates should renew automatically through your host or server software rather than by hand.

Yes, modestly. Google has used HTTPS as a lightweight ranking signal for years, and an HTTP site also suffers indirectly: browser warnings make visitors leave quickly, and features like installable apps need HTTPS. Switching to HTTPS will not push a weak site to the top, but staying on HTTP in 2026 is a clear disadvantage.

What is the difference between SSL and TLS?

SSL was the original protocol for encrypting web traffic. It was replaced by TLS years ago because of security flaws, and modern sites use TLS 1.2 or 1.3. The certificates are the same kind of file either way, so the industry still calls them SSL certificates. When you buy or install an SSL certificate today, it is used for TLS connections.

Is EV SSL worth it for a small business?

Usually not. EV certificates involve the strictest identity checks, but since 2019 major browsers no longer show the green bar or company name that made them visible to customers. Visitors see the same address bar for DV and EV. EV can still make sense if a contract, regulator or corporate client specifically requires it.

Why does my site say "Not secure" if I have SSL?

Common causes are an expired certificate, a certificate that covers only www or only the bare domain, pages still loading images or scripts over http:// (mixed content), or the site not redirecting HTTP to HTTPS. Check the certificate details in your browser, then test the site with an SSL checker to see which issue applies.

Does an SSL certificate stop hackers?

No. It encrypts data between the visitor and your server and proves the domain is yours, but it does nothing about outdated plugins, weak passwords or malware already on the site. Hacked sites often keep a valid padlock. You still need updates, two-factor login, backups and monitoring to keep the site itself secure.

Speed & Security

SSL Certificates Explained for Business Owners: What They Do, Whether You Need One, and What They Cost in 2026

By ITCM Team · Updated November 2026

An SSL certificate is a small data file on your web server that proves your domain's identity and lets browsers open an encrypted HTTPS connection, shown by the padlock or settings icon in the address bar. Every business website needs one in 2026: without it, browsers label the site "Not secure" and Chrome now warns visitors before loading plain HTTP pages. For most small businesses the right certificate costs nothing, because free certificates from Let's Encrypt or your host encrypt traffic just as well as basic paid ones. What matters more is that it renews automatically, because certificate lifetimes are getting much shorter.

Key takeaways

SSL (technically TLS) encrypts traffic between visitors and your site and proves the domain is yours.
Every business site needs one; without it browsers show "Not secure" warnings.
Free DV certificates are fine for most small business websites.
OV and EV add company checks, but browsers no longer show a green bar or company name.
Maximum certificate lifetime is 200 days since March 2026 and falls to 47 days by 2029, so auto-renewal is essential.
SSL protects data in transit; it does not stop your site from being hacked.

What is an SSL certificate, in plain English?

Think of an SSL certificate as two things in one: a sealed envelope and an ID card. The envelope part is encryption. When someone fills in your contact form or logs in, the data travels scrambled, so anyone snooping on public Wi-Fi sees nonsense. The ID card part is identity. A trusted certificate authority has checked that whoever installed the certificate actually controls your domain.

The name SSL is old; the protocol in use today is TLS, but everyone still says SSL certificate. When it works, your address starts with https:// and the browser shows a padlock or, in recent Chrome versions, a neutral settings icon in its place.

Do I need an SSL certificate for my business website?

Yes, even if your site has no shop and no logins. Browsers mark every HTTP page as "Not secure", and Chrome 154, released in October 2026, turns on its "Always use secure connections" setting by default for public sites. That means visitors see a warning they must click through before an HTTP-only site loads. Few customers will.

HTTPS is also a long-standing Google ranking signal, and many modern browser features, such as installable apps (PWAs), location access and some payment tools, only work on HTTPS. If your site is already showing a warning, our guide on how to fix the "Not secure" warning walks through the fix.

DV vs OV vs EV: which type of certificate do you need?

All three types encrypt traffic with the same strength. The difference is how much the certificate authority checks before issuing it.

Extended Validation used to put a green bar with the company name in the address bar. Chrome and Firefox removed that display in 2019, so visitors no longer see any difference between DV and EV without clicking into certificate details. For most small businesses that makes EV hard to justify.

DV (Domain Validated): proves you control the domain. Issued in minutes, often free. Right for most brochure, service and booking sites.
OV (Organization Validated): also verifies your business is a real, registered organisation. Takes a day or more. Sometimes required by corporate clients or procurement rules.
EV (Extended Validation): the strictest checks on legal identity and address. Takes days. Mainly used by banks and large enterprises for policy reasons.

How much does an SSL certificate cost in 2026?

Prices below are typical annual retail ranges at the time of writing. Resellers discount heavily, and many hosts bundle a free DV certificate automatically.

If someone is charging you $100 a year for a basic DV certificate on a small site, ask why. Unless you need OV/EV for a contract or policy, free is usually the right answer.

Certificate type	Validation	Typical price per year
Let's Encrypt or host-provided	DV	Free
Paid single domain	DV	$7 to $100
Single domain	OV	$30 to $300
Single domain	EV	$75 to $400
Wildcard (*.yourdomain.com)	DV	$79 to $200
Multi-domain (SAN)	OV	$140 to $300
Multi-domain (SAN)	EV	$250 to $500+

Free vs paid SSL: is a free certificate good enough?

For encryption, yes. A free Let's Encrypt certificate uses the same standards and is trusted by the same browsers as a paid DV certificate. Most hosts and website platforms issue and renew one for you without you doing anything.

Paid certificates make sense in narrower cases.

A client, insurer or tender requires OV or EV.
You want a warranty or vendor support line bundled with the certificate.
Your setup cannot run automated renewal and you need a commercial tool to manage it.
You need a certificate type your host does not offer for free.

Why certificate lifetimes are shrinking (and why auto-renewal matters)

Browser makers and certificate authorities agreed to cut the maximum lifetime of publicly trusted certificates in steps. On 15 March 2026 it dropped from 398 days to 200 days. It falls to 100 days in March 2027 and to 47 days in March 2029. Let's Encrypt already issues 90-day certificates by default and plans to go shorter.

The practical result: manually buying and installing a certificate once a year is over. If a person has to remember to renew, sooner or later it will be missed. Make sure your host or developer has automatic renewal in place and that someone gets an alert if it fails.

What happens when an SSL certificate expires?

Visitors get a full-page browser warning, such as "Your connection is not private", instead of your homepage. Most people leave immediately, contact forms stop being used, and any app or integration that calls your site may fail. Nothing is wrong with your content; the browser simply cannot confirm the site is genuine.

The fix is to renew or reissue the certificate and install it, which takes minutes with automatic tools. The lasting fix is making renewal automatic so it never depends on a calendar reminder.

What an SSL certificate does NOT do

The padlock is often misread as "this site is safe". It only means the connection is encrypted and the domain is verified. Scammers routinely use free certificates on phishing sites, and a hacked WordPress site still shows a padlock while serving malware.

SSL does not patch outdated plugins, block brute-force logins, remove malware or back up your site. Those need updates, strong passwords with two-factor login, monitoring and backups, covered in our website security guide.

Wildcard and multi-domain certificates: when do you need them?

A standard certificate covers one hostname, usually with and without www. A wildcard covers all first-level subdomains, such as shop.yourdomain.com and booking.yourdomain.com. A multi-domain (SAN) certificate covers several different domains in one certificate, useful if you run a few brands.

Small businesses rarely need either: Let's Encrypt issues free wildcard certificates (with DNS validation), and most hosts simply issue a separate free certificate for each domain or subdomain you add.

How to check your SSL certificate

Click the icon to the left of your address in the browser and open the connection or certificate details. You will see who issued it, which domains it covers and when it expires. For a fuller check, our free SSL and security headers checker shows the certificate, expiry date and the security headers your site sends.

Expiry date: is it renewing automatically, well before the date?
Coverage: do both www and non-www versions work over HTTPS?
Redirects: does http:// send visitors to https:// automatically?
Mixed content: do any images or scripts still load over http://?

How ITCM handles SSL and HTTPS

When ITCM builds a site, HTTPS is part of the build, not an upsell: the demo link you review runs over HTTPS, and the installable app that comes with the site depends on it. You see the finished website and app first, and pay $150 one-time only if you are happy, with anything extra quoted at a fixed price before work starts.

For businesses that want certificates, renewals, monitoring and security headers watched for them, our website security service and optional care plan from $100 a month cover it. We also clean up and secure hacked WordPress sites, where an expired or misconfigured certificate is often only one of several problems.

Frequently asked questions

Is an SSL certificate free?: It can be. Let's Encrypt issues free, browser-trusted DV certificates, and most hosting companies and website platforms install and renew one for you at no charge. You pay only if you choose an OV or EV certificate, want vendor support or a warranty, or your setup cannot use automatic renewal. For a typical small business website, a free certificate is the sensible choice.
How long does an SSL certificate last?: Since 15 March 2026, publicly trusted certificates can last at most 200 days. That drops to 100 days in March 2027 and 47 days in March 2029. Let's Encrypt certificates last 90 days by default. Because lifetimes keep shrinking, certificates should renew automatically through your host or server software rather than by hand.
Does SSL affect SEO?: Yes, modestly. Google has used HTTPS as a lightweight ranking signal for years, and an HTTP site also suffers indirectly: browser warnings make visitors leave quickly, and features like installable apps need HTTPS. Switching to HTTPS will not push a weak site to the top, but staying on HTTP in 2026 is a clear disadvantage.
What is the difference between SSL and TLS?: SSL was the original protocol for encrypting web traffic. It was replaced by TLS years ago because of security flaws, and modern sites use TLS 1.2 or 1.3. The certificates are the same kind of file either way, so the industry still calls them SSL certificates. When you buy or install an SSL certificate today, it is used for TLS connections.
Is EV SSL worth it for a small business?: Usually not. EV certificates involve the strictest identity checks, but since 2019 major browsers no longer show the green bar or company name that made them visible to customers. Visitors see the same address bar for DV and EV. EV can still make sense if a contract, regulator or corporate client specifically requires it.
Why does my site say "Not secure" if I have SSL?: Common causes are an expired certificate, a certificate that covers only www or only the bare domain, pages still loading images or scripts over http:// (mixed content), or the site not redirecting HTTP to HTTPS. Check the certificate details in your browser, then test the site with an SSL checker to see which issue applies.
Does an SSL certificate stop hackers?: No. It encrypts data between the visitor and your server and proves the domain is yours, but it does nothing about outdated plugins, weak passwords or malware already on the site. Hacked sites often keep a valid padlock. You still need updates, two-factor login, backups and monitoring to keep the site itself secure.

Get a website + app built for free

We build your website and mobile app first, and you see it finished. If you’re happy, you pay $150 one-time. If you’re not, you pay nothing.

See the $150 offer Free website audit

← All articles