How much does an SSL certificate cost?
Short answer, with prices checked on November 5, 2026:
- Free: Let's Encrypt certificates, and AWS Certificate Manager (ACM) certificates used on AWS load balancers, CloudFront or API Gateway.
- About $6 to $110 a year: a basic domain-validated (DV) certificate for one domain, depending on where you buy it.
- About $40 to $160 a year: a DV wildcard certificate for all subdomains of one domain.
- About $20 to $400 a year: an organization-validated (OV) certificate.
- About $46 to $1,500 a year: an extended validation (EV) certificate.
Prices change often and resellers show first-year discounts, so check the renewal price before you buy. The sections below give the exact numbers and sources.
Strictly speaking, these are TLS certificates. SSL is the old name of the protocol, but everyone still says "SSL certificate", so we do too.
What you actually pay for
All public certificates use the same encryption. A $6 certificate and a $1,000 certificate protect the connection in the same way. The price difference comes from three things:
- Validation level. For a DV certificate the CA only checks that you control the domain, and it takes minutes. For an OV certificate the CA also checks that your organization exists. For an EV certificate the check is stricter and takes days.
- Coverage. One domain, all subdomains of one domain (wildcard), or a list of different domains (multi-domain, also called SAN or UCC).
- Brand and extras. Big CAs charge more for the name, support, warranty and management tools.
SSL certificate prices by type
All prices are for one year, in US dollars, checked on November 5, 2026. Reseller prices are for the cheapest plan shown on the page; the renewal price is given where the page shows it.
Free SSL certificate
Let's Encrypt issues free DV certificates, including wildcard and multi-domain ones. It doesn't issue OV or EV certificates. Many hosting control panels support it out of the box, cert-manager uses it in Kubernetes, and Certbot or another ACME client renews it automatically.
ACM public certificates are also free, but only on AWS services like load balancers, CloudFront and API Gateway. More on that in the AWS section below.
Domain validation (DV) certificate
- Namecheap Standard SSL: from $5.99 a year on a 5-year plan, renews at $6.99 a year (Namecheap).
- GoGetSSL: DV from $16 a year (GoGetSSL).
- Sectigo directly: from $110 a year for a single-domain DV certificate (Sectigo).
The same type of certificate can cost 18 times more depending on where you buy it. Resellers buy in bulk from CAs and sell cheaper.
Cheapest wildcard SSL certificate
A wildcard certificate covers every first-level subdomain of one domain, but not deeper levels and not a different domain (DigiCert):
shell
1*.example.com covers: shop.example.com, blog.example.com2 does not cover: a.b.example.com, example.orgFor several different domains you need a multi-domain certificate.
- Let's Encrypt: free, needs the DNS-01 challenge, so your DNS provider must support API updates.
- Namecheap Standard Wildcard SSL (DV): from $39.99 a year, renews at $44.39 (Namecheap).
- GoGetSSL wildcard: from $72 a year (GoGetSSL).
- AWS ACM exportable wildcard: $79 per issuance and again per renewal (AWS).
- OV wildcard: from $117.99 a year at Namecheap, renews at $126.25 (Namecheap).
Multi-domain (SAN) certificate
- Let's Encrypt: free, up to 100 names in one certificate, depending on the profile (Let's Encrypt).
- Namecheap SAN Certificate (DV, 3 domains included): from $19.50 a year, renews at $23.40.
- GoGetSSL multi-domain: from $44 a year.
Organization validation (OV) certificate
- Namecheap High Assurance SSL: from $19.99 a year, renews at $23.99.
- GoGetSSL OV: from $32.80 a year.
- DigiCert Basic: $218 list price; DigiCert Secure Site: $399 (DigiCert).
Extended validation (EV) certificate
- Namecheap EV SSL: from $45.99 a year, renews at $55.19.
- DigiCert Basic EV: $344 list price; Secure Site EV: $995; Secure Site Pro EV: $1,495 (DigiCert).
EV used to show the company name in a green address bar. Chrome moved that information into the site info panel back in Chrome 77, so visitors no longer see a difference between DV, OV and EV unless they click to look. Buy EV only if a contract, a regulator or your security policy asks for it.
AWS SSL certificate cost (ACM and EC2)
AWS Certificate Manager has two kinds of public certificates (ACM pricing, checked November 5, 2026):
- Regular public certificates: $0. ACM issues and renews them for free, but you can't download the private key. They work only on integrated AWS services such as Application and Network Load Balancers, CloudFront and API Gateway. The load balancer itself has an hourly charge.
- Exportable public certificates: $7 per domain name and $79 per wildcard name. You get the certificate and the private key and can install them anywhere, including directly on an EC2 instance. AWS charges at issuance and again at every renewal. With certificates now limited to about 200 days, that means paying roughly twice a year.
For a single EC2 instance, the cheapest working option is usually a free Let's Encrypt certificate on the instance. We compare all three ways step by step in our guide to installing and renewing an SSL certificate on AWS EC2.
Certificate lifetimes are getting shorter
You can still buy a "1-year" or "2-year" certificate, but that's a subscription now, not one certificate. The CA/Browser Forum, the group of CAs and browser makers that sets the rules for public certificates, passed ballot SC-081v3 in 2025. The maximum lifetime of a public TLS certificate goes down in steps (Baseline Requirements, section 6.3.2):
- issued from March 15, 2026: up to 200 days;
- issued from March 15, 2027: up to 100 days;
- issued from March 15, 2029: up to 47 days.
Let's Encrypt is also moving from 90-day certificates to 45-day ones (Let's Encrypt):
- now: 90 days by default, 45 days if you opt in to the
tlsserverprofile; - from February 10, 2027: 64 days by default;
- from February 16, 2028: 45 days by default.
What this means for the budget: the old argument "free certificates have to be renewed too often" is gone. Paid certificates are renewed every few months as well, and in 2029 they'll be renewed more often than Let's Encrypt is today. If you pay for a certificate, pay for validation or support, not for a longer lifetime. And automate renewal either way.
Do e-commerce sites need a paid certificate?
SSL is especially important for e-commerce sites, where customers type in card numbers, addresses and passwords. The certificate encrypts that traffic so nobody between the customer and your server can read or change it.
But a free DV certificate encrypts it just as well as a paid EV one. What an online store really needs is HTTPS on every page, automatic renewal and a correct server configuration. Paid OV or EV makes sense when a payment provider, a client contract or a compliance audit asks for a verified organization in the certificate.
What an SSL certificate does and doesn't do
- It protects the connection. Data between the browser and your server can't be read or quietly changed on the way.
- It doesn't stop phishing. A fake copy of your site can get its own free certificate for its own lookalike domain in minutes. A certificate proves control of a domain, not that the site is honest.
- Browsers warn about sites without it. Chrome marks plain HTTP pages as "Not secure". With a certificate, the address bar shows a neutral icon: Chrome replaced the padlock with a "tune" icon in 2023, because HTTPS is now the default state, not a special one.
- It helps SEO a little. Google uses HTTPS as a ranking signal, but calls it "a very lightweight signal". The bigger SEO risk is a broken or expired certificate: visitors see a full-page warning and leave.
The hidden cost: installation, renewal and monitoring
The certificate itself is often the cheapest part. The real cost is the engineer's time to install it, renew it and fix it when something breaks. With lifetimes going down to 47 days, manual renewal stops being an option.
SSL certificate installation
A free Let's Encrypt certificate on Ubuntu with Nginx takes a few commands and renews itself. Our step-by-step guides show how to install Let's Encrypt on Ubuntu and how to automate it across many servers with Ansible. A paid certificate takes more steps: create a private key and CSR, pass validation, install the certificate with the full chain, and repeat at every reissue.
SSL certificate monitoring
If you run a number of sites, renewal will fail somewhere sooner or later: a DNS change, a firewall rule, a full disk. Monitor expiry dates separately from renewal. A quick manual check with OpenSSL:
shell
1echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -subject -issuer -enddateFor a script or a cron job, -checkend returns a non-zero exit code when the certificate expires within the given number of seconds (here, 14 days):
shell
1echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -checkend 1209600SSL certificate error fix
A wrong configuration shows up as a browser error, not a search engine one: a missing intermediate certificate, a certificate for the wrong name, an expired certificate or a wrong system clock. The browser doesn't trust the certificate and shows a full-page security warning. We've collected the common causes and fixes in our guide to the "Your connection is not private" error.
How ITSyndicate can help
You don't need to overpay for a certificate. For most sites a free certificate with automated renewal is the right choice, and the guides above are enough to set it up yourself.
We don't sell or install certificates as a separate service. TLS is part of the wider infrastructure work our cloud security and compliance team does: certificates with automated renewal and expiry monitoring, server hardening, access control and audits. If that is what you need, get in touch with the team.