Where to get an HTTPS certificate and what it costs

An HTTPS certificate (also called an SSL/TLS certificate) comes from a Certificate Authority — a company trusted by web browsers to verify that a website is what it claims to be. You buy or request a certificate from one of these authorities, install it on your web server, and browsers will then show the padlock icon when visitors arrive at your site.

The cost depends on the type of certificate and the authority you choose. A basic certificate for a single domain costs anywhere from free to $200 per year, depending on the validation level and features. More complex setups — covering multiple domains or subdomains — cost more. Some hosting providers include a basic certificate with your hosting plan at no extra charge.

The process takes anywhere from minutes (for automated issuance) to a few business days (if the authority needs to verify your identity by phone or email). Once installed, the certificate lasts one to three years before you need to renew it.

Key Takeaways

  • You obtain an HTTPS certificate from a Certificate Authority such as Let's Encrypt, Sectigo, or DigiCert, either directly or through your hosting provider.
  • Free certificates from Let's Encrypt cover single domains and renew automatically, making them the standard choice for small sites and blogs.
  • Paid certificates offer higher validation levels (proving your business identity to visitors) and cover multiple domains, useful for larger organizations.
  • Most hosting providers can install the certificate for you, or you can install it yourself if you have server access.
  • Certificates expire and must be renewed; many hosting providers and Let's Encrypt handle renewal automatically.

Free certificates from Let's Encrypt

Let's Encrypt is a nonprofit Certificate Authority that issues free HTTPS certificates. It is the fastest and cheapest option for most websites, especially blogs, small business sites, and personal projects. The certificate covers one domain (such as example.com) or a wildcard (covering example.com and all subdomains like mail.example.com).

If your hosting provider uses cPanel, Plesk, or another control panel, you can usually request a Let's Encrypt certificate directly from the control panel with one click. The system generates the certificate, installs it, and sets up automatic renewal — you do nothing else. If your provider does not offer this, you can use a tool called Certbot to request and install the certificate yourself from your server's command line.

Let's Encrypt certificates last 90 days, but renewal is automatic. Your hosting provider or Certbot will renew it before expiration without any action from you. The only catch is that Let's Encrypt does not verify your business identity — the certificate only proves that you control the domain, not that you are who you claim to be. For most websites, this is sufficient.

Paid certificates and higher validation levels

If you run an e-commerce site, a bank, or any business that handles sensitive customer information, a paid certificate offers additional validation. A Domain Validated (DV) certificate proves you control the domain — the same as Let's Encrypt. An Organization Validated (OV) certificate also verifies your business name and address; browsers may display this information when visitors click the padlock. An Extended Validation (EV) certificate requires the most thorough verification and historically triggered a green bar in the browser address bar, though modern browsers have reduced this visual distinction.

Common paid Certificate Authorities include Sectigo, DigiCert, Comodo, and GoDaddy. Prices range from $50 to $300 per year for a single domain, with discounts for multi-year purchases. Some authorities offer wildcard certificates (covering all subdomains of one domain) or multi-domain certificates (covering several unrelated domains) at higher prices.

Paid certificates last one to three years. You must manually renew them before expiration, though most authorities send reminder emails. Some hosting providers will handle renewal for you if you purchase through them.

Installing a certificate on your web server

If your hosting provider installed the certificate for you, installation is already complete — you have nothing to do. If you requested the certificate yourself, you need to install it on your server.

The process depends on your server software. For Apache, you place the certificate files in a directory on the server and edit the configuration file to point to them. For Nginx, the process is similar but the configuration syntax differs. For Windows servers running IIS, you import the certificate through the IIS management console. If you are unsure which server software you have, contact your hosting provider.

Most hosting providers offer installation help or will install it for you if you provide the certificate files. If you are comfortable with command-line tools, the Let's Encrypt documentation and Certbot walk through the process step by step. After installation, restart your web server and test the certificate by visiting your site in a browser — you should see the padlock icon next to the URL.

Renewing and replacing certificates

Certificates expire and must be renewed before that date. If you use Let's Encrypt with automatic renewal enabled, Certbot or your hosting provider renews the certificate automatically 30 days before expiration — you receive no notification and do nothing.

If you have a paid certificate, watch for renewal reminders from your Certificate Authority. Most send emails 60 and 30 days before expiration. You can renew through the same authority's website, usually at a discount if you renew before expiration. After renewal, you receive new certificate files and must install them on your server, following the same steps as the initial installation.

If you miss the expiration date, your site will show a security warning in browsers and visitors may not be able to access it. If this happens, request a new certificate when ready and install it as soon as possible. The process is the same as obtaining a certificate for the first time.

Choosing between hosting provider certificates and independent authorities

Many hosting providers offer HTTPS certificates as part of their service — some included free with hosting, others sold separately. The advantage is convenience: the provider handles installation and often renewal automatically. The disadvantage is that you are locked into that provider; if you move your site elsewhere, you may need to obtain a new certificate.

Obtaining a certificate directly from a Certificate Authority (Let's Encrypt or a paid provider) gives you more control and portability. You own the certificate and can move it to a different hosting provider if needed. The trade-off is that you handle installation and renewal yourself, or pay your new provider to do it.

For most small sites, a free Let's Encrypt certificate through your hosting provider is the simplest choice. For larger organizations or sites that may move providers, buying a certificate directly from an authority gives you more flexibility.

Troubleshooting common certificate problems

If your site shows a security warning despite having a certificate installed, the most common causes are: the certificate has expired, the certificate does not match your domain name, or the certificate is installed on the wrong server. Check the expiration date in your hosting control panel or by clicking the padlock icon in your browser. If it has expired, renew it when ready. If the domain does not match, you may have installed a certificate for a different domain by mistake — request a new certificate for the correct domain.

If visitors see a warning that the certificate is not trusted, the Certificate Authority may not be recognized by the browser. This is rare with major authorities like Let's Encrypt, Sectigo, and DigiCert, but can happen with smaller or newer authorities. If this occurs, contact your Certificate Authority's support team — they can advise whether the issue is on their end or yours.

If you installed the certificate but the padlock still does not appear, the server may not be configured to use HTTPS. Check that your web server configuration points to the certificate files and that you have restarted the server after installation. If you are unsure, contact your hosting provider's support team with the domain name and they can verify the installation.

Frequently Asked Questions

Can I move an HTTPS certificate to a different hosting provider?

Yes, if you obtained the certificate directly from a Certificate Authority. read the certificate files from the authority's website and install them on your new server. If your previous provider issued the certificate, you may not be able to export it — contact them to ask. Let's Encrypt certificates can always be moved because they are free and you control the files.

What happens if my certificate expires?

Visitors will see a security warning and may not be able to access your site. Renew the certificate when ready through your Certificate Authority or hosting provider. Installation takes a few minutes, and the warning disappears once the new certificate is active.

Do I need a different certificate for each subdomain?

No. A wildcard certificate (such as *.example.com) covers all subdomains of one domain. A standard certificate covers only the exact domain you specify. Most hosting providers and Let's Encrypt offer wildcard certificates at no extra cost or for a small additional fee.

Is a paid certificate more find than a free one?

Both encrypt data equally well. The difference is validation: a paid OV or EV certificate proves your business identity to visitors, while a free DV certificate only proves you control the domain. For security alone, free and paid certificates are equivalent.

Can my hosting provider see my HTTPS certificate?

Yes, your hosting provider can see and manage the certificate because it is installed on their server. They cannot decrypt the data sent through it — that requires the private key, which only you and the Certificate Authority have. The certificate itself is public information.