How to Set Up a Free SSL Certificate for Your Website
Since 2018, Chrome has labeled every plain HTTP page as "Not secure," and that warning alone is enough to make visitors close a contact form or abandon a checkout. An SSL certificate, more accurately a TLS certificate today, is a small digital file issued by a certificate authority that proves your server controls a domain and lets browsers encrypt traffic between the visitor and your site over HTTPS. The good news is that you should never pay for a basic certificate again. This guide shows how to set one up for free on any common hosting setup and how to keep it renewing without thinking about it.
Quick Answer: To get a free SSL certificate, enable your host's built-in SSL option if it has one, or install Let's Encrypt with Certbot on your own server. Point your domain's DNS to the server first, request the certificate, redirect all HTTP traffic to HTTPS, fix mixed content, and confirm automatic renewal works with a dry run.
How SSL Certificates Work and Why Free Ones Are Enough
An SSL certificate works by binding your domain name to a cryptographic key pair, so a browser can verify it is talking to your real server before encrypting the connection. The certificate authority, or CA, is the trusted third party that checks you control the domain and signs the certificate.
Certificates come in three validation levels. Domain Validated (DV) certificates prove control of the domain and nothing more. Organization Validated (OV) and Extended Validation (EV) certificates add checks on the business behind it. The encryption strength is the same across all three. Modern browsers no longer give EV certificates special visual treatment in the address bar, so for nearly every small site, a free DV certificate provides identical protection to visitors.
Validation depends on DNS, because the CA must reach your server at your domain. Before requesting anything, confirm the domain already points to your host; if you are unsure how that works, this guide explains how DNS records connect a domain to a server.
The CA most free certificates come from is Let's Encrypt, a nonprofit run by the Internet Security Research Group. It issues DV certificates through an automated protocol called ACME. Its certificates are valid for 90 days, which sounds short but is intentional: short lifetimes limit damage from compromised keys and force automation, which is more reliable than a calendar reminder.
Four Ways to Get a Free SSL Certificate
There are four common routes to a free certificate, and the right one depends on how much control you have over your server. Choose the first option that applies to you.
- Use your platform's automatic HTTPS. GitHub Pages, Netlify, Vercel, Cloudflare Pages, and Render issue and renew certificates automatically once your domain is connected. There is nothing to install.
- Use your shared host's control panel. Most cPanel and similar hosts provide AutoSSL or a Let's Encrypt button. Enable it for the domain and both its www variant.
- Install Certbot on your own server. On a VPS or cloud server, the Electronic Frontier Foundation's Certbot client requests Let's Encrypt certificates and can configure Nginx or Apache for you.
- Put Cloudflare in front of your site. Cloudflare's free plan issues an edge certificate for your domain. Pair it with an origin certificate or a Let's Encrypt certificate on your server for end-to-end encryption.
Other free ACME-compatible CAs exist, such as ZeroSSL, and tools like acme.sh or Caddy's built-in automatic HTTPS can use them. The underlying process is the same: prove control of the domain, receive a certificate, and renew automatically before it expires.
Choosing the Right Validation Method
ACME certificate authorities verify domain control through challenges, and picking the right one avoids most failed requests. The table compares the two challenges you are most likely to use.
| Factor | HTTP-01 Challenge | DNS-01 Challenge |
|---|---|---|
| How it proves control | Places a token file on your web server at a known path | Adds a TXT record to your domain's DNS |
| Requires port 80 open | Yes | No |
| Supports wildcard certificates | No | Yes |
| Automation needs | Access to the web server | API access to your DNS provider |
| Best for | Single servers serving their own domains | Wildcards, internal servers, multiple servers |
For a typical single-server website, HTTP-01 through Certbot's Nginx or Apache plugin is the simplest path. Choose DNS-01 when you need a wildcard such as *.example.com, or when the server is not reachable from the internet on port 80.
Certificate Lifetimes Are Getting Shorter: Why Automation Matters
Automatic renewal is no longer optional, because industry rules are steadily shortening how long any certificate can last. This section combines published policy changes with practitioner analysis.
In 2025, the CA/Browser Forum, the body of certificate authorities and browser makers that sets certificate rules, approved a schedule that reduces the maximum lifetime of publicly trusted TLS certificates in stages, reaching 47 days by 2029. Paid certificates are affected just like free ones. Teams that still renew certificates manually each year will be forced to renew many times a year, and every manual step is a chance for an outage.
Let's Encrypt also stopped sending certificate expiration reminder emails in 2025, explaining that automation had made them largely unnecessary. In practice, that means nobody will warn you if renewal silently breaks. The sites I see going down with certificate errors almost always share one cause: a renewal job that failed months ago because a firewall rule, a DNS change, or a server migration broke the challenge.
The practical answer is to use platforms that renew for you where possible, and on your own servers, to test renewal and monitor certificate expiry with an external uptime checker. Your hosting type determines how much of this is your responsibility, which is covered in this comparison of how your hosting type affects certificate control.
Common SSL Setup Mistakes and How to Fix Them
Most broken HTTPS setups come from a few repeatable configuration errors. Check these first whenever the padlock is missing or the browser shows a warning.
- Requesting a certificate before DNS points to the server. The challenge fails because the CA reaches the old host. Confirm DNS with
digbefore requesting. - Covering only one hostname. A certificate for
example.comdoes not coverwww.example.com. Include both names in the request. - Mixed content. The page loads over HTTPS but pulls images, scripts, or fonts over HTTP, so browsers show warnings or block assets. Update URLs to HTTPS or relative paths, and in WordPress, update the site URL settings.
- Cloudflare Flexible mode with HTTPS redirects on the server. Flexible sends traffic to your server over HTTP while your server redirects to HTTPS, creating an endless redirect loop. Use Full (strict) with a valid certificate on the origin.
- Port 80 blocked by a firewall. HTTP-01 challenges need port 80 reachable. Keep it open and redirect to HTTPS rather than closing it.
- Forgetting to reload the web server after renewal. A renewed certificate on disk is not used until Nginx or Apache reloads. Certbot's plugins handle this; custom setups need a deploy hook.
- Enabling HSTS preload too early. HSTS tells browsers to always use HTTPS. Preloading is hard to undo, so enable it only after every subdomain supports HTTPS.
- Copying private keys around insecurely. Keep private keys on the server with restricted file permissions, and never commit them to a repository.
Walkthrough: Let's Encrypt With Certbot on an Nginx Server
Installing a free certificate on your own Linux server with Nginx takes a few commands. This walkthrough assumes Ubuntu or Debian, a working Nginx site, and DNS already pointing at the server.
Step 1: Confirm DNS and the server block. Check that example.com and www.example.com resolve to your server, and that your Nginx configuration includes both in its server_name line.
Step 2: Install Certbot. Follow the EFF's Certbot instructions for your operating system and web server. The recommended method on many distributions is the snap package, which keeps Certbot updated automatically.
Step 3: Request the certificate. Run sudo certbot --nginx -d example.com -d www.example.com. Certbot completes the HTTP-01 challenge, installs the certificate, and offers to configure the HTTP to HTTPS redirect.
Step 4: Accept the redirect. Choose the redirect option so every visitor lands on HTTPS. Then load the HTTP version of your site to confirm it redirects.
Step 5: Test renewal. Run sudo certbot renew --dry-run. A successful dry run means the scheduled renewal job, installed as a systemd timer or cron entry, will work when it matters.
Step 6: Check your configuration externally. Use a public SSL testing tool to inspect protocol versions, the certificate chain, and any configuration warnings.
Step 7: Fix mixed content. Open your site with the browser console visible and look for mixed content warnings. Update every asset URL that still uses HTTP.
Step 8: Add monitoring. Configure an uptime monitor that alerts you when the certificate is close to expiring, so a silent renewal failure never becomes a public outage.
On shared hosting, the same outcome takes a different path. Open the SSL or Let's Encrypt section of your control panel, select the domain and its www variant, and issue the certificate. Then enable the host's "force HTTPS" option or add a redirect rule in .htaccess. For WordPress, update both the WordPress Address and Site Address settings to use https://, and run a search-and-replace on the database for old http:// links to your own domain, using a tool that handles serialized data safely. Finally, open a few older posts with the browser console visible, because embedded images from years ago are the most common source of lingering mixed content warnings.
Key Takeaways
- Free Domain Validated certificates from Let's Encrypt provide the same encryption strength as paid certificates for typical websites.
- Most modern hosts and platforms issue and renew certificates automatically once your domain points to them.
- HTTP-01 challenges suit single servers, while DNS-01 challenges are required for wildcard certificates.
- Certificate lifetimes are shrinking under CA/Browser Forum rules, making automated renewal essential rather than optional.
- Mixed content, missing www coverage, and Cloudflare Flexible mode cause most broken HTTPS setups.
Frequently Asked Questions
Is a free SSL certificate as secure as a paid one?
Yes, for encryption a free Let's Encrypt certificate is as secure as a paid Domain Validated certificate. Both use the same standards and are trusted by major browsers. Paid certificates may add organization validation, warranties, or support, but they do not encrypt traffic more strongly.
How long does a Let's Encrypt certificate last?
Let's Encrypt certificates are valid for 90 days. The short lifetime is deliberate and assumes automated renewal, which Certbot and most hosting platforms handle for you. Certbot typically renews certificates well before they expire, so a working renewal job means you never notice the 90-day limit.
Why does my site still say Not Secure after installing SSL?
The most common reason is mixed content, where the HTTPS page still loads images, scripts, or stylesheets over HTTP. Other causes include visiting the HTTP address without a redirect or a certificate that excludes the hostname you used. Check the browser console for specific warnings.
Can I get a free wildcard SSL certificate?
Yes, Let's Encrypt issues free wildcard certificates such as *.example.com, but only through the DNS-01 challenge. You need to add a TXT record to your DNS, ideally automated through your DNS provider's API so renewals happen without manual steps every few months.
Do I need SSL if my website does not collect data?
Yes, every website should use HTTPS. It prevents networks from injecting ads or malware into your pages, protects visitors' privacy about which pages they read, removes browser warnings, and is required for many modern browser features. With free certificates, there is no cost reason to skip it.
What is the difference between SSL and TLS?
TLS is the modern successor to SSL, and all current secure websites use TLS. The older SSL protocol versions are deprecated and insecure. People still say SSL certificate out of habit, but the certificates you install today are used with TLS connections.
Conclusion
The most important decision with SSL is choosing a setup that renews itself, because a certificate is only as reliable as its renewal process. Let your platform handle HTTPS when it can, use Certbot with a tested dry run when you run your own server, and monitor expiry either way. With your site encrypted, the next layer of protection is recovery, so make sure you are backing up your site on a schedule before you ever need to restore it.
