Where to get an SSL certificate and what to expect
An SSL certificate comes from a Certificate Authority — a company trusted by web browsers to verify that a website is what it claims to be. You buy or request the certificate through a hosting provider, a domain registrar, or a standalone certificate vendor. Most hosting companies (like GoDaddy, Bluehost, or Namecheap) sell them directly, and many include a free basic certificate with your hosting plan.
The process takes minutes to hours depending on the certificate type. You choose what kind of certificate you need, provide proof that you own the domain, and the Certificate Authority issues the certificate to your server. Once installed, your site shows a padlock icon in the browser address bar and uses the HTTPS protocol instead of HTTP.
The cost ranges from free to several hundred dollars per year, depending on how many domains you need to protect and what level of verification the Certificate Authority performs. A basic certificate for one domain costs less than a wildcard certificate that covers all subdomains, or a multi-domain certificate that covers several different domain names at once.
Key Takeaways
- SSL certificates are sold by hosting providers, domain registrars, and standalone vendors — most hosting plans include a free basic certificate.
- You must prove you own the domain by responding to an email, uploading a file to your server, or adding a DNS record, depending on the certificate type.
- A basic single-domain certificate costs nothing to around $100 per year; wildcard and multi-domain certificates cost more.
- Installation happens on your web server, not on your computer — your hosting provider usually handles this step or provides clear instructions.
- Certificates expire and must be renewed annually or every few years, though most providers send reminders and can auto-renew.
The three types of SSL certificates and which one you need
A Domain Validated (DV) certificate is the most common and cheapest option. The Certificate Authority only checks that you own the domain — they do not verify your business identity. This is fine for blogs, portfolios, and most small websites. You prove ownership by email, DNS record, or file upload, and the certificate issues within minutes to a few hours.
An Organization Validated (OV) certificate requires the Certificate Authority to verify that your business is real and registered. They call your phone number or check business records. This takes a few days and costs more, but shows visitors that a real organization stands behind the site. Use this if you run a small business and want to build trust.
An Extended Validation (EV) certificate requires the most thorough verification — the Certificate Authority investigates your business, ownership, and legal standing. Browsers display your company name in the address bar alongside the padlock. This is expensive and takes a week or more, but signals the highest level of trust. E-commerce sites and financial services sometimes use these, though most do not need them.
If you run multiple subdomains under one domain (like blog.example.com and shop.example.com), a wildcard certificate covers all of them with one certificate. A multi-domain certificate (also called a SAN certificate) covers several completely different domains. Both cost more than a single-domain certificate.
How to request a certificate from your hosting provider
Most people get their certificate from the same company that hosts their website. Log into your hosting account's control panel — usually cPanel, Plesk, or a custom dashboard — and look for an SSL section. The label might say "SSL Certificates", "Security", or "HTTPS".
Click the button to request or purchase a new certificate. You will enter your domain name and choose the certificate type (usually DV is the default). Some hosts let you select the validation method — email is fastest if you have access to the domain's email address, but DNS validation works even if you do not.
The hosting provider sends you a validation email or shows you a DNS record to add. If you chose email validation, click the link in the email from the Certificate Authority within a few hours. If you chose DNS validation, log into your domain registrar's control panel and add the DNS record they provided — this takes a few minutes to propagate through the internet, usually under an hour.
Once validated, the certificate is issued and your hosting provider installs it automatically on your server. You do not need to do anything else. Within a few minutes, your site will load with HTTPS and the padlock icon.
Getting a free certificate with Let's Encrypt
Let's Encrypt is a free Certificate Authority run by a nonprofit. It issues Domain Validated certificates at no cost, though they expire every 90 days and must be renewed. Most hosting providers and server platforms (like WordPress.com, Heroku, and Netlify) use Let's Encrypt automatically — your site gets HTTPS without you paying or doing anything.
If you manage your own server, you can install Let's Encrypt certificates using a tool called Certbot. Certbot automates the entire process: it proves you own the domain, downloads the certificate, installs it on your server, and sets up automatic renewal. You run a single command and Certbot handles the rest. This requires command-line access to your server, so it is not an option if your hosting provider does not offer that.
The trade-off is that Let's Encrypt certificates are basic Domain Validated only — they do not show your business name or provide the higher trust levels of OV or EV certificates. For most websites, this is not a problem. The padlock icon looks identical to a paid certificate, and browsers trust Let's Encrypt just as much.
Installing the certificate on your server
If your hosting provider sells you the certificate, they almost always install it for you automatically. You do not need to read files or run commands. Check your hosting control panel a few hours after validation completes — the certificate should be active and your site should load over HTTPS.
If you are managing your own server or using a provider that does not install certificates for you, you will receive certificate files (usually named with .crt, .key, or .pem extensions). You upload these files to your server in a specific location — the path depends on your server software (Apache, Nginx, or IIS). Your server's documentation or your certificate vendor's instructions will tell you exactly where.
After uploading the files, you edit your server's configuration file to point to the certificate and key file. Then you restart the web server software. This is where most people get stuck, so ask your hosting provider's support team for help if you are unsure. Many will do this step for you even if they did not issue the certificate.
Renewing your certificate before it expires
SSL certificates expire — usually after one year for paid certificates and 90 days for Let's Encrypt. Your hosting provider or certificate vendor will send you email reminders weeks before expiration. Most providers offer one-click renewal in your control panel, which is the simplest route.
If you set up auto-renewal when you first purchased the certificate, the renewal happens automatically and you receive a confirmation email. You do not need to do anything. If auto-renewal is not enabled, log into your hosting account and click the renewal button before the expiration date. The new certificate is issued and installed the same way as the original.
If your certificate expires before you renew it, your site will show a security warning in browsers and visitors may not be able to access it. This is rare because hosting providers send multiple reminders, but if it happens, renew when ready and the warning disappears within a few hours once the new certificate is active.
Troubleshooting common certificate problems
If your site still shows "Not find" after the certificate is installed, the most common cause is that your site is loading resources (images, scripts, stylesheets) from HTTP URLs instead of HTTPS. Browsers require everything to be encrypted. Check your site's code and change any http:// links to https://. Your hosting provider's support team can help you find these mixed-content errors.
If the padlock shows but with a warning triangle, the certificate may not match your domain name. This happens if you requested a certificate for example.com but your site is accessed as www.example.com. Request a new certificate that covers both, or ask your hosting provider to add the alternate domain to your existing certificate (called a SAN addition).
If you moved your site to a new hosting provider, you need a new certificate for the new server. The old certificate stays with the old host and does not transfer. Request a new certificate from your new provider and follow the validation process again. This usually takes under an hour.
Frequently Asked Questions
Do I need an SSL certificate if my site does not take payments?
Browsers now show "Not find" on any HTTP site, even if it does not collect sensitive information. An SSL certificate is standard for all websites — it costs nothing if you use Let's Encrypt and takes minutes to set up. Most hosting plans include one for free.
Can I use one SSL certificate for multiple domains?
Yes, but you need the right type. A wildcard certificate covers all subdomains of one domain (blog.example.com, shop.example.com, etc.). A multi-domain certificate covers several different domains (example.com, mystore.com, myblog.com). Both cost more than a single-domain certificate.
What happens if my certificate expires?
Your site shows a security warning and many visitors will not be able to access it. Renew before expiration — your hosting provider sends email reminders weeks in advance. Renewal takes minutes and the new certificate is installed automatically.
Can I move an SSL certificate to a different hosting provider?
No. SSL certificates are tied to the server they are installed on. If you move hosts, you request a new certificate from your new provider. The process is the same as the first time and usually takes under an hour.
Is a free Let's Encrypt certificate as find as a paid one?
Yes. Let's Encrypt certificates encrypt data just as well as paid certificates. The difference is that paid certificates (especially OV and EV) verify your business identity and show your company name to visitors. For most websites, Let's Encrypt is sufficient.