How to Get a Free SSL Certificate

What an SSL certificate does

Strictly speaking, today's connections use TLS, the successor of SSL, but everyone still says "SSL certificate". A certificate does two things:

• Encryption: passwords, forms and payments travel scrambled, so nobody on the network can read or change them.
• Identity: a certificate authority (CA) has checked that whoever asked for the certificate controls the domain.

Free certificates are domain-validated (DV): the CA checks that you control the domain, nothing more. The encryption is exactly as strong as a paid certificate's. Paid OV and EV certificates add checks on the organisation behind the site, which some businesses want, but browsers show the same padlock for all of them.

The free options compared

All of them encrypt equally well. The difference is how they are issued and renewed, and that matters more every year.

Why automatic renewal matters

Certificates are getting shorter-lived across the whole industry. Under the CA/Browser Forum rules, the longest a public certificate may last is 200 days since March 2026, 100 days from March 2027 and 47 days from March 2029.

Let's Encrypt certificates last 90 days today. Its default certificates move to 64 days in February 2027 and 45 days in February 2028. Let's Encrypt also stopped sending expiry reminder emails in 2025, so nobody will warn you before a certificate runs out.

The practical lesson: never renew certificates by hand. Use something that renews them on its own, such as AutoSSL in cPanel or Certbot on a VPS, and check now and then that it works.

On shared hosting: AutoSSL in cPanel

On cPanel hosting there is usually nothing to do. AutoSSL requests a Let's Encrypt certificate for every domain on the account that points at the server, installs it and renews it before it expires.

1. Point your domain at the hosting: set the nameservers or the A record your host gave you, and wait for DNS to update.
2. In cPanel, open Security → SSL/TLS Status. Each domain shows whether it is covered, expiring or has an AutoSSL problem.
3. If a domain is not covered yet, click Run AutoSSL. It works only once the domain resolves to the server.
4. Open your site with https:// and check the padlock. With WordPress, set the site address to https:// too.

On HytHost web hosting, AutoSSL with Let's Encrypt is on for every plan and covers each domain and subdomain you add once it points at the server. What else cPanel does is in what is cPanel.

On a VPS: Certbot with nginx

On your own server, Certbot from the EFF gets Let's Encrypt certificates and renews them. The official method on Ubuntu uses the snap package:

sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/local/bin/certbot

Make sure your domain's A record points at the VPS, that nginx has a server_name for it, and that ports 80 and 443 are open in the firewall. Then run:

sudo certbot --nginx -d example.com -d www.example.com

Certbot proves you control the domain, installs the certificate in your nginx configuration and can redirect HTTP to HTTPS. It also installs a timer that renews certificates automatically. Test renewal once:

sudo certbot renew --dry-run

Behind Cloudflare

If your domain runs through Cloudflare with the orange cloud on, visitors connect to Cloudflare, which shows them its free Universal SSL certificate. That covers only half the trip: Cloudflare still connects to your server.

• Set SSL/TLS mode to Full (strict). Cloudflare then requires a valid certificate on your server, so the whole path is encrypted and checked.
• Give your server a certificate: Let's Encrypt through AutoSSL or Certbot works, or a free Cloudflare Origin CA certificate. An Origin CA certificate is trusted only by Cloudflare, so visitors see errors if you ever turn the proxy off.
• Avoid Flexible mode. It leaves the connection to your server unencrypted and often causes redirect loops.

Common SSL problems and fixes

• The certificate will not issue: the domain does not point at the server yet, or DNS still has the old address cached. Check the A record and wait.
• A CAA record blocks it: if your DNS has CAA records, they must allow the CA you use, for example 0 issue "letsencrypt.org".
• Validation fails on a VPS: Let's Encrypt checks over port 80 by default, so keep port 80 open even if the site redirects to HTTPS.
• "Not secure" despite a certificate: the page loads images or scripts over http:// (mixed content). Change those links to https://.
• A wildcard certificate: *.example.com needs DNS validation, so it works only with a DNS plugin or provider that can create the verification record.
• The certificate expired: automatic renewal stopped working. Check the SSL/TLS Status page in cPanel, or run certbot renew --dry-run on a VPS and read the error.