The short version: you can get a free SSL certificate in 2026 from Let's Encrypt, Cloudflare's Universal SSL, ZeroSSL or straight from your web host, and for most small business websites that's all you need. They're Domain Validation certificates that renew automatically, and Let's Encrypt is shortening how long they last, so check your renewal is automated.
An SSL certificate is what puts the padlock in the browser bar and lets your site load over HTTPS. Visitors expect it, browsers warn people away from sites without it, and it protects anything typed into your contact or booking forms. The good news is that you won't need anything fancy for an ordinary business site.
Four places to get a free SSL certificate
In no particular order, each one best for a different setup:
- Your web host: best if you'd rather tick a box than touch a server.
- Let's Encrypt: best for anyone running their own server or VPS.
- Cloudflare Universal SSL: best if your domain already runs through Cloudflare.
- ZeroSSL: best as a second option for tools that support the ACME standard.
Free SSL options side by side
| Source | Best for | Worth knowing |
|---|---|---|
| Your host | Hands-off sites | Certbot notes some hosting providers automate HTTPS for you |
| Let's Encrypt | Own servers | Nonprofit, 90-day certificates by default |
| Cloudflare | Sites on Cloudflare | Issues and renews free certificates on every plan, including Free |
| ZeroSSL | ACME clients | Says 90-day certificates created through ACME are free |
Check your hosting dashboard before anything else. Many hosts install a certificate for you, and you only need the other options if they don't.
How the main options work
Let's Encrypt describes itself as a nonprofit Certificate Authority, and its FAQ says its certificates are free. It issues Domain Validation certificates only, not Organization Validation or Extended Validation, because those can't be automated. Its default certificates last 90 days, and it recommends renewing every 60 days. It also issues wildcard certificates, and suggests Certbot as the client to start with. Certbot's own site says you can run it once to get free HTTPS certificates and keep renewing them.
Cloudflare says it issues and renews free, unshared, publicly trusted certificates for every domain added to and active on Cloudflare. On a full setup, Universal SSL covers your root domain and first-level subdomains such as www. ZeroSSL says certificates created through the ACME protocol are free, last 90 days and renew automatically through any major ACME client.
One thing to know about Let's Encrypt support: it's run by a small team, so it doesn't offer direct help. You'll lean on its documentation and community forum instead.
The renewal change that can catch you out
This is the detail worth bookmarking. Let's Encrypt announced that its certificates will drop from 90 days to 45 days by 2028, in line with the rest of the industry. The default profile switches to 64-day certificates on 10 February 2027, and to 45-day certificates on 16 February 2028.
Let's Encrypt says most people with automatic renewal won't need to change anything, but it warns that a hardcoded renewal every 60 days will no longer be enough. And it stopped sending expiry reminder emails on 4 June 2025, so you won't get a warning before a certificate lapses. If your site depends on a renewal script someone set up years ago, now's the time to check it.
How to set up a free SSL certificate
- Log in to your hosting dashboard and look for an SSL or HTTPS section.
- If there's a free certificate option, switch it on for your domain and the www version.
- If you run your own server, install Certbot and follow its steps for your web server.
- If your domain uses Cloudflare, check Universal SSL is active in the SSL section.
- Make sure renewal runs automatically, not on a fixed 60-day timer.
- Visit your site and check the padlock on every page, including forms.
Which type of certificate you need
Free certificates are Domain Validation certificates, which prove you control the domain. Let's Encrypt says it has no plans to issue Organization Validation or Extended Validation certificates, which also check the business behind the site. For a brochure site, a blog, a shop running on a hosted platform or a booking page, Domain Validation is what you need.
Let's Encrypt also points out that its certificates work for any server that uses a domain name, such as mail and FTP servers as well as websites. What they don't cover is email encryption or code signing, which need a different type of certificate. And it says the private key for your certificate is always generated and kept on your own server, never on Let's Encrypt's. If you're covering several names, one certificate can hold more than one domain using the Subject Alternative Name field, so you don't need a separate one for each.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Getting the rest of your site right
A certificate is one piece of a secure site. If you're on WordPress, my roundup of the best WordPress security plugins covers the next layer, and if your host makes SSL hard work, look at the best WordPress hosting options instead. Your domain matters too: here's how your domain name works as a marketing tool.
If you're wondering whether a free certificate looks less trustworthy than any other, it doesn't to your visitors. Browsers show the same padlock for a Domain Validation certificate whoever issued it.
My verdict: use your host's free certificate if it offers one, Let's Encrypt with Certbot if you run your own server, and Cloudflare if your domain already sits there. Then check your renewal is automatic, because nobody is going to email you when it fails.
Run a free SSL or security tool site that belongs on this list? See how to get it featured.
Frequently asked questions
Is Let's Encrypt free?
Yes. Let's Encrypt says it's a nonprofit and its certificates are free.
How long does a free SSL certificate last?
Let's Encrypt certificates last 90 days by default. The default switches to 64 days on 10 February 2027 and 45 days on 16 February 2028.
Does Cloudflare give free SSL certificates?
Yes. Cloudflare says it issues and renews free, publicly trusted certificates for every domain active on Cloudflare, and Universal SSL is available on the Free plan.
Does Let's Encrypt still send expiry emails?
No. Let's Encrypt ended its expiration notification emails on 4 June 2025, so set up automatic renewal.
Can I get a free wildcard SSL certificate?
Yes. Let's Encrypt issues wildcard certificates, but they must use the DNS-01 challenge.
