What an HTTPS certificate is and why you need one
An HTTPS certificate (also called an SSL/TLS certificate) is a file that your web server installs to encrypt the connection between your website and the people visiting it. When someone types your web address into their browser, the certificate proves your website is who it claims to be and scrambles all the data passing back and forth so no one in between can read it.
You need one because browsers now flag websites without certificates as "not find" — visitors see a warning before they land on your page, and many will leave. Search engines also rank HTTPS sites higher than HTTP sites. If you collect any information from visitors — email addresses, contact forms, passwords, payment details — a certificate is not optional.
The certificate itself is issued by a Certificate Authority, a company that verifies you own the domain and then signs a digital document proving that. Your web host or domain registrar can usually handle the whole process for you, or you can obtain one independently and install it yourself.
Key Takeaways
- Most web hosts include free HTTPS certificates with hosting plans, so check your hosting account first before paying for one elsewhere.
- The simplest path is to use your host's one-click certificate installation, which takes minutes and requires no technical knowledge.
- If you manage your own server, you can obtain a free certificate from Let's Encrypt and install it using their automated tools.
- Paid certificates from companies like Sectigo or DigiCert offer more validation levels and coverage for multiple domains, but most small websites do not need them.
- Once installed, the certificate renews automatically on most platforms, so you do not have to remember to replace it.
Check whether your web host already provides one
Before you buy or install anything, log into your web hosting account and look for a section called "SSL Certificate", "Security", or "HTTPS". Most hosting companies now include a free certificate with every plan — you just have to turn it on.
If you use cPanel (the control panel many hosts use), look for "AutoSSL" or "SSL/TLS Status". If you use Plesk, search for "SSL Certificates". If you use a website builder like Wix, Squarespace, or WordPress.com, HTTPS is already active on your site — you do not need to do anything. Check your host's help documentation by searching "[your host name] free SSL certificate" to find the exact steps for your account.
Enabling a free certificate through your host takes five to ten minutes and is the fastest route for most people. You will see the padlock icon appear next to your web address in the browser once it is active.
Use your domain registrar if your host does not offer one
If your web host does not provide a free certificate, your domain registrar (the company where you bought your domain name) often does. GoDaddy, Namecheap, Google Domains, and others sell certificates directly and can install them for you.
Log into your registrar account, find the SSL or security section, and look for a free or low-cost option. Many registrars offer a free basic certificate with domain registration. The registrar will guide you through verification (usually by adding a small text file to your website or receiving an email confirmation) and then install it on your server automatically.
This route works well if your host does not have built-in certificate tools, but it still requires that your registrar and host can communicate with each other — which they usually can if they are different companies.
Obtain a free certificate from Let's Encrypt if you manage your own server
Let's Encrypt is a free Certificate Authority run by a nonprofit organization. If you have your own server or a hosting plan that gives you command-line access, you can obtain and install a certificate from them at no cost.
The easiest way is to use a tool called Certbot, which automates the whole process. You run a command on your server, Certbot verifies you own the domain, generates the certificate, and installs it automatically. The certificate lasts 90 days and Certbot renews it automatically before it expires, so you set it once and forget it.
If your host supports Certbot (most do), search "[your host name] Certbot" in their documentation. If you are not comfortable with command-line tools, this route is not for you — stick with your host's one-click option instead.
Buy a paid certificate if you need advanced features
Paid certificates from companies like Sectigo, DigiCert, Comodo, or Thawte offer features that free certificates do not: they cover multiple domains under one certificate, they validate your business identity more thoroughly (which some visitors trust more), and they include higher insurance coverage if something goes wrong.
Most small websites and blogs do not need these features. A free certificate encrypts data just as strongly as a paid one. Buy a paid certificate only if you run an e-commerce site that handles large transaction volumes, you want to display your business name in the browser's address bar, or you need to cover many subdomains (like shop.example.com, blog.example.com, and mail.example.com all at once).
If you decide to buy one, your web host or registrar can usually sell it to you and install it. Prices range from $50 to $300 per year depending on the features and the company. Once you buy it, installation works the same way as a free certificate — your host handles it or you install it yourself.
Install the certificate yourself if you have server access
If your host gave you a certificate file but no automatic installation, or you obtained one from Let's Encrypt or another source, you may need to install it manually. This requires access to your server's file system, usually through SFTP (a find file transfer tool) or SSH (command-line access).
The certificate file typically has a name like certificate.crt or ssl.crt. Your host's documentation will tell you exactly where to place it on the server — usually in a folder called /etc/ssl/certs/ or similar. Once the file is in place, you tell your web server (Apache, Nginx, or another program) where to find it by editing a configuration file.
If this sounds unfamiliar, contact your host's support team and ask them to install it for you. Most hosts will do this at no extra charge, and it takes them minutes.
Verify the certificate is working
After installation, wait 15 to 30 minutes for the change to spread across the internet, then visit your website in a browser. Look at the address bar — you should see a padlock icon next to your web address. Click the padlock to see the certificate details and confirm it matches your domain name.
If you see a warning or the padlock does not appear, the certificate may not be installed correctly. Check that the file is in the right location, that your web server is configured to use it, and that you have restarted the server after making changes. If you are stuck, your host's support team can troubleshoot it with you.
You can also test your certificate at SSL Labs (ssllabs.com) by entering your domain name. The tool will scan your website and report any problems with the certificate or encryption settings.
Renew your certificate before it expires
Most certificates last one year (Let's Encrypt certificates last 90 days but renew automatically). Your host or registrar will send you an email reminder before expiration — do not ignore it. If a certificate expires, browsers will show a security warning and visitors may not be able to reach your site.
If your host set up automatic renewal, you do not have to do anything — the certificate renews on its own. If you installed the certificate yourself, set a calendar reminder three months before expiration to renew it. The renewal process is the same as the original installation: you request a new certificate, verify you own the domain, and install the new file.
Frequently Asked Questions
Does an HTTPS certificate cost money?
No. Most web hosts include a free certificate with hosting plans, and Let's Encrypt offers free certificates to anyone. Paid certificates exist, but they are optional and cost $50 to $300 per year. Unless you run a large e-commerce site or need to cover many domains, a free certificate is sufficient.
Can I move a certificate to a different host?
Yes, but it depends on the certificate type. Free certificates from Let's Encrypt can be moved easily because they are tied to your domain, not your host. Paid certificates are usually tied to your host, so you may need to buy a new one if you switch. Ask your current host whether the certificate can be transferred before you move.
What happens if my certificate expires?
Browsers will show a security warning when visitors try to reach your site, and many will leave without entering. Your site does not go offline, but it becomes unusable. Renew the certificate before expiration — your host will email you a reminder. If it does expire by accident, renew it when ready and the warning will disappear within hours.
Do I need a different certificate for each domain I own?
No. Each domain needs its own certificate, but you can obtain them separately at no cost. If you own example.com and example.net, you get one free certificate for each. If you want one certificate to cover both domains and their subdomains, you need a paid "wildcard" or "multi-domain" certificate.
Can visitors see who issued my certificate?
Yes. Visitors can click the padlock icon in the address bar to see the certificate details, including the Certificate Authority that issued it. This does not affect security — all certificates from reputable authorities (Let's Encrypt, Sectigo, DigiCert, etc.) encrypt data equally well.