The padlock is on. Your site says “Secure”. Visitors can browse, sign up, and pay without their browser screaming warnings at them. So why do some companies still sell SSL certificates for hundreds of euros a year — and do you need one?
Short answer: for almost every website, the free certificate is all you need. But “almost” hides a few real cases where paid makes sense. Here’s how to tell which side you’re on.
First: what SSL actually does (and doesn’t)
An SSL/TLS certificate does two things: it encrypts the traffic between your visitor and your site, and it proves the domain in the address bar really belongs to the server answering. That’s it. It does not make your website secure from hacking, does not scan for malware, and does not protect your database. Those are hosting and application concerns. The certificate’s job begins and ends with the connection.
Both free and paid certificates do this job equally well. A free certificate from Let’s Encrypt — the nonprofit certificate authority that issues the majority of certificates on the web today — uses the same encryption strength as a €300 one. Browsers show the same padlock for both. There is no “gold padlock”.
Where free certificates come from
Free certificates exist because Let’s Encrypt (and similar CAs like ZeroSSL) automated the whole issuance process. Instead of a human verifying your paperwork, a machine verifies that you control the domain — usually in seconds. Most good hosting companies (including every AriHosting plan) install and auto-renew these for every domain automatically, so you never think about them again.
What a paid certificate actually adds
When you pay for an SSL certificate, what you’re buying is not stronger encryption — it’s one of two extras:
- Extended validation of identity. A paid certificate can carry verified information about the organisation behind the site — legal name, registered company, sometimes physical address. Visitors don’t see this in the address bar anymore (browsers removed the green company-name bar years ago), but it’s embedded in the certificate itself.
- Insurance and support. Paid certificates often come with a warranty (if the CA mis-issues a certificate that defrauds one of your users, they pay out) and human support when something breaks.
There’s a third category worth mentioning only to dismiss it: wildcard certificates, which cover unlimited subdomains (shop.example.com, blog.example.com, etc.). These used to be paid-only — but free CAs issue wildcard certificates too now, so this is no longer a reason to pay.
When the free certificate is all you need
- Blogs, portfolios, brochure sites — nothing to decide; free wins on every axis.
- Online shops and SaaS that take payments on someone else’s checkout — if you use Stripe, PayPal, or Mollie, the payment pages run on their domain with their certificates. Yours just needs basic encryption, which is free.
- Standard business sites collecting contact forms — free, full stop.
When paying genuinely makes sense
- You’re a bank, insurer, or handle large financial flows under your own domain. An EV-style certificate with verified organisation details can matter for compliance or partner requirements — even if visitors never see it.
- A contract requires it. Some enterprise or government tenders specify a paid certificate from a named CA. If a procurement document demands one, that’s your answer.
- You need the insurance. Rare, but high-traffic e-commerce operations sometimes value the warranty and support SLA.
Notice what’s not on this list: SEO. Google has confirmed that all valid certificates — free or paid — are treated the same in rankings. Paying for SSL will not move you up in search results.
One-minute decision checklist
- Does a contract, regulator, or partner explicitly require a paid certificate? → If yes, buy one.
- Are you a financial institution under your own domain with compliance requirements? → Consider it.
- Everything else? → Free certificate, auto-renewed by your host. Done.
Every AriHosting plan includes free SSL certificates on all your domains — installed and renewed automatically, so the padlock never lapses. Compare the plans here.