How to Get an SSL Certificate [+10 Best Free SSLs]

Protecting users' data on websites that I help develop is a high priority. There are several security protocols that can be used to protect customers as they browse your website. However, the Secure Sockets Layer (SSL) certificate is my go to. This is because SSL is inexpensive — and there are free SSL certificates available for you to use today.

An SSL certificate keeps customers’ sensitive information secure as they visit pages, read posts, submit interest forms, and purchase products. In this post, I'll share everything you need to know about SSL certificates and the best free SSL certificates you can get, regardless of your budget.

Table of Contents

• What is an SSL certificate?
• Why get an SSL certificate?
• How SSL Certificates Work
• How much is an SSL?
• How to Get an SSL Certificate
• Best Free and Low-Cost SSL Certificate Authorities
• Should you get a self-signed SSL certificate?

Why get an SSL certificate?

A website is more than just a digital billboard. It’s a data highway between a business and its visitors. Anytime a visitor accesses a website, data, like their IP address, gets transferred from one server to another before it reaches its destination. Your visitors expect your company to keep that data secure.

Without a secure connection, the data they share is at risk of falling into the wrong hands, compromising their privacy, which could have steep consequences for any business. I wouldn‘t risk that — and you shouldn’t either. Not to mention, if a site experiences a data breach, your credibility will suffer. That's where SSL comes into the picture. Let’s dive deeper into why an SSL certificate is important.

Free SSL Certificate

Build a secure site with a free SSL certificate in HubSpot.

• Prioritize user experience with a built-in SSL.
• Get a free SSL without plugins.
• Design, secure, and promote in one platform.
• Give users and browsers confidence.

Get started free

Securing Data Transfer

As information is exchanged between the business’s website and the visitor's browser, the data is encrypted to achieve a secure exchange. I compare this to when I am signing up for a new bank account. I am typically asked for sensitive identifying information. Luckily, I know that my information is safely encrypted as long as my bank is using an industry standard security protocol.

Improving SEO Ranking

Search engines value websites that provide secure and encrypted sessions for their visitors. By using an SSL certificate, I automatically enhance my website’s SEO performance because search engines like to see this factor when ranking websites.

Gaining Users’ Trust

Given that I work in tech, I understand that not all warnings are actual fires. However, it is important that we create user friendly applications and using an SSL certificate can help. Without using SSL, user’s will see a scary warning message that says the website may be fake.

However, including an SSL certification will let them know that their visit is safe. If you need guidance on other ways you can make your site safe and more trustworthy, check out this checklist for website safety.

In short, SSL is a must have. It’s a no-brainer to include it for my clients who process financial transactions on their website. However, I would make sure my site has SSL regardless of that. This added layer of security will protect companies from data breaches, giving visitors a good reason to trust sharing their sensitive information.

It’s worth the energy to get an SSL certificate — and considering getting an SSL certificate can be free, there’s no reason not to. It just takes a few extra steps, and I'll walk you through those now.

More of a visual learner? Check out this quick video on what SSL is and why it's a must-have:

Ready to dive a little deeper? Let's do it.

How SSL Certificates Work

SSL certificates can be a bit complicated to understand with all the technical jargon and acronyms. I’ll give you a simple but accurate overview of how SSL certificates work by walking you through what happens when I visit my favorite website, hubspot.com.

Verification

Initially, I open my laptop and type “hubspot.com” into my web browser, Google Chrome. While Google Chrome loads the site, my computer receives HubSpot’s SSL certificate through a public key and verifies it with the certificate authority. This is the first step.

Handshake

My computer and HubSpot’s server agree that everything looks legitimate, and the two computers form a connection called a handshake.

Encryption

From here, my computer and the hubspot.com server decide on the type of encryption they’ll use to transmit data back and forth securely. What makes this connection secure is the coding and decoding of information while it is in transit between the computer and the server.

The timeframe where security attacks are prone to happen is when the data is moving from one place to the next. Scrambling the information in an encrypted language, or private key, keeps everything secure until it gets where it needs to be.

Authentication

Once the data is decrypted by my computer by the private key, a lock icon appears next to the website’s name in the browser’s search bar.

It looks like this:

As a user, I expect to see that lock when I visit a website. If I don‘t, I don’t trust the site as much. I want to make sure my visitors don't bounce out of fear of a data breach— this is why I stress the importance of having an SSL certificate.

In my example, I am free to browse hubspot.com, because I know that any data I share is safe and won’t be intercepted by malicious hackers.

How much is an SSL?

The cost of an SSL certificate can range from free to hundreds of dollars, depending on the level of security required. Here are the types of SSLs, ranging from least secure to most secure (and, generally, lowest to highest in price):

• Domain Validated (DV) Certificates. I typically use DV certificates for sites such as blogs or small business websites when customer information isn’t being exchanged.
• Organization Validated (OV) Certificates. OV certificates are best for business websites with forms and lead capture capabilities that don’t exchange sensitive customer information.
• Extended Validated (EV) Certificates. I pick the EV certificate when the highest level of security is needed when sensitive information is being exchanged, such as financial transactions.

The type of SSL I choose depends on what types of actions I expect users to take on the site. SSL certificates can be expensive if you don‘t know where to look or what you’re buying. Luckily, I'm here to help you.

Once I choose the type of certificate I require, I can then shop around for Certificate Authorities that offer SSLs at that level. After I find the perfect certificate, I am then ready to install the certificate on my website.

Here’s how I get an SSL certificate from start to finish:

HubSpot's Free Website Builder

Create and customize your own business website with an easy drag-and-drop website builder.

• Build a website without any coding skills.
• Pre-built themes and templates.
• Built-in marketing tools and features.
• And more!

Get Started for Free

1. Verify your website’s information through ICANN Lookup.

Before applying for an SSL certificate, I confirm that my ICANN Lookup record is updated and matches what I will submit to the Certificate Authority. You can also check your information by accessing the ICANN lookup tool and look at your name server, your registrar information, and your authoritative servers.

2. Generate the Certificate Signing Request (CSR).

Before finding a certificate authority, I recommend generating a Certificate Signing Request (CSR). This text is generated on my server and includes information about my domain and business.

I can create a CSR through my server, cPanel, or an online CSR generator. I'll walk you through the different options now:

Option 1: Server

If I have access to my server, I can generate a CSR myself. I use this guide to find my server’s specific instructions. This option is recommended for advanced users and web developers.

Option 2: cPanel

If my hosting provider gives me access to my cPanel, I can also generate a CSR using its tools. First, I access my cPanel via my hosting provider. When I use Bluehost, my cPanel is located under “Advanced.”

Then, I scroll down to a section titled “Security.” From there, I click the “SSL/TSL” option.

From there, I usually see an option to generate a CSR. In Bluehost, this option is located on the right-hand sidebar.

After I click it, I’ll be taken to a form that asks for my domain, city, state, country, and company.

Done! My CSR has been generated.

Option 3: Online CSR Generator

Lastly, I can bypass any complicated steps and simply use an online CSR generator for free. Some of those options include:

• Namecheap's CSR Generator (Recommended for Advanced Users)
• Digicert’s CSR Wizard (Recommended for Beginners)

I usually use this option as a last resort because it’s not connected to my server, hosting service, or cPanel.

If you’re unsure how to move forward, I'd recommend that you contact your hosting company for support, and they’ll give you instructions specific to your website. They can advise you on the type of CSR certificate you should request.

3. Submit the CSR to the Certificate authority to validate my domain.

When I buy an SSL certificate from a certificate authority, I must submit my CSR. I always make sure to have it on hand when I’m completing the sign-up process for my SSL certificate.

4. Install the certificate on my website.

Lastly, I’ll install the certificate on my website. The best way to do so is through cPanel. Under “Security,” I’ll click “SSL/TLS.” Then click “Manage SSL sites.”

There, I’ll be able to upload a new certificate to my chosen domain.

If I purchased an SSL via my hosting provider, the certificate may already be automatically installed on my site. In this case, I may not need to manually do it.

Now I will show you the best services that you can use to get an SSL?

When I am developing for a blog or business site that requires a lower level of encryption for a blog or business site and doesn’t transfer sensitive financial information, the following gets the job done. I think it’s important to remember that free SSL certificates might not be the right fit for all websites. However, if you feel like it might work for you, here’s where you’d start.

1. HubSpot

Learn more about HubSpot's CMS with SSL.

If you have content hosted on HubSpot's CMS, you can secure your content and lead data with a free SSL certificate. When you create your website, you’ll get a natively integrated SSL certificate. This ensures that you won’t have to pay any additional money for setup.

Price:Content Hub is free and therefore, so is hosting. You can also opt for the premium if you're seeking advanced functionality.

Key Features

• Automatically included with website
• Doesn’t require plugins
• Beginner-friendly with drag-and-drop website creation

Best for: This option is best for companies who use Hubspot to build their website.

2. Let’s Encrypt

Let's Encrypt was created by the Linux Foundation, and the project was sponsored by Mozilla, Site Ground, Cisco, Facebook, Akamai, and other top tech companies.

It offers DV SSL certificates (no OV or EV here) free of cost, but you should be aware that these certificates are only valid for three months at a time and should be renewed every sixty days at the earliest. Why? The company has a firm stance on automatic certificate renewals to achieve its long-term goal of moving the web from HTTP to HTTPS.

Price: Always free for three months at a time. Then you must renew, for free, for another three months. Having to renew may be a little bit of a hassle, but you are getting SSL for free, so I think it's worthwhile.

Key Features

• Easy certificate issuance and revocation
• Domain validation
• Wild certificates available

What I like: Let’s encrypt is beginner friendly thanks to its descriptive documentation. If you are new to securing your website, you will have no problem installing your SSL if you use the Let’s Encrypt documentation.

3. Comodo

Comodo offers you an SSL certificate for 30 days, completely risk-free.

It was especially designed for MS Exchange and Office servers. Comodo offers unlimited server licenses with priority phone support. And, most importantly, Comodo is certified as a Best Seller of SSL certificates.

Key Features

• Multi-domain domain validation
• Fast certificate issuance
• Compatible with most major browsers and devices

Price: DV SSL Certificate for one domain is $99/year, Multi-Domain is $279/year, and Wildcard is $449/year.

HubSpot's Free Website Builder

Create and customize your own business website with an easy drag-and-drop website builder.

• Build a website without any coding skills.
• Pre-built themes and templates.
• Built-in marketing tools and features.
• And more!

Get Started for Free

Best For: If you have more than one server under your domain, Comodo allows you to use the same SSL certificate on as many servers as you need to. This is perfect for organizations that use microservice architecture for their applications.

4. Cloudflare

Cloudflare is known for its products that make websites faster and more secure. It‘s a CDN and security company that’s used by many popular sites, including Reddit, Mozilla, and Stack Overflow. Cloud Flare blocks millions of attacks every day and provides 24/7 support.

Price: $0 - $200 per month

Key Features

• HTTPS available at all levels
• Backup certificates automatically included
• Multiple SSL modes

What I like: If you don’t want to handle configuring your SSL certificate, Cloudflare will do it for you. You can also set your certificate to auto-renew.

5. SSL For Free

SSL For Free is a nonprofit certificate authority, and it works on all major browsers. Like Let’s Encrypt and other SSL certificate authorities, SSL For Free offers certificates valid for three months at a time.

Price: Always free for three months at a time. Then you must renew, for free, for another three months.

Key Features

• Available for commercial use
• 90-day renewal process
• WWW is optional

What I like: I recently worked on a group project where our team decided to use subdomains under our main domain for better section organization. We were able to use SSL to generate a certificate that covered all of the domains. I highly recommend SSL For Free if you need to add security protocols to subdomains under your main domain.

6. GoDaddy

You‘ve heard of GoDaddy — with over 60 million domains, it’s the world’s number-one name registrar. If you have an open-source project, GoDaddy will provide you with a free SSL certificate that's valid for a year.

Price: $69.99 - $129.99 per year

Key Features

• End-to-end encryption protocol
• Certificate issuance in 5 minutes or less
• Hands-on support

What I like: When developers have software ideas that they would like to release to the public, we don’t always have the financial support starting out. I love how GoDaddy contributes to making technology accessible to everyone by giving free SSL certs to open-source projects.

7. GeoTrust

GeoTrust offers a full range of DV, OV, and EV SSL certificates, and automated domain name validation is included with each. They’re known for having easy installation, speedy certificate issuance and compatibility with leading desktop and mobile browsers.

Price: Ranges, starting at $159 for a one-year plan

Key Features

• Flexible plans
• $500k USD warranty
• Unlimited certification reissues

What I like: GeoTrust is great for enterprises like government and financial operations. You can be sure to trust its identity check process, as it’s one of the most thorough processes in the industry.

8. GoGetSSL

GoGetSSL is another public SSL certificate provider. It gives you a 90-day free trial for SSL certificates, and it only takes about five minutes to get your domain validated (no callback or face-to-face verification required). Their certificates are compatible with all major browsers, such as Chrome, Firefox, Opera, and Safari.

Price: Starting at $14.21 per year

Key Features

• 30-day money-back guarantee
• Mobile Friendly

What I like: If you really like GoGetSSL features but are thinking of settling for another company due to a cheaper price, GoGetSSL will match the price match. This option makes their SSL certification super affordable for any budget.

9. Instant SSL

Instant SSL is another option that deserves your attention. Unlimited server licensing, 24/7 support, and unlimited re-issuance are among the features included in their SSL certificate options.

Price: $78 per year and up

Key Features

• Free 24/7 customer service
• Trust Logo
• $50,000 SSL certificate warranty

Best for: Instant SSL offers options for small to large businesses. For companies whose business and traffic demand fluctuates, this is a great option that will adapt to your needs.

10. Basic SSL

Basic SSL also offers a 90-day trial before you make a purchase. With a quick and simple validation process, you can focus on other aspects of your website while Basic SSL takes care of the certificate for you.

Price: Free for 90 days

Key Features

• 99% browser compatibility
• Fully automated
• Unlimited server licenses

Best for: If you would rather not deal with handling the security of your website, SSL is the perfect option for you. This is great for someone who is super busy or setting up their first website.

Should you get a self-signed SSL certificate?

When it comes to SSL certificates there are two types, a self-signed or certificate authority. I like to think of it like the USDA Organic seal. Anyone can claim that their food is organic but only farms that have been certified by the USDA can stamp their products with the USDA Organic seal.

A self-signed certificate is similar, where I can create a private key that tells my visitors that my site is trustworthy. However, I won’t get the stamp of approval because this hasn’t been verified by a trusted authority.

With a self-signed certificate, the connection between my visitor’s browser and my server is encrypted. However, without the stamp of approval from the certificate authority, visitors will see a warning message from their browser like this:

This is because the browser only recognizes certificate authorities as legitimate. This can hurt any business and scare visitors away.

I recommend you only use self-signed certificates if you are building an application that your team will use internally for things like testing or a personal project. This way, your visitors are people who know the warning message isn’t anything to be afraid of. I shared several free SSL options that come with the verified stamp, so why not take advantage of the most beneficial option?

Protect Your Customer’s Experience on Your Website

Browsing the web has its risks, but I feel better knowing that I can virtually eliminate those for visitors on my site. With an SSL certificate from a reputable company, my website can safely and securely handle data transfers between my clients and their businesses. With a visible lock icon in the search bar, site visitors know they can trust the business. I think it's worth the extra energy and effort.

Ultimately, this creates a better user experience, increases my website’s ranking in search results, and ultimately helps my clients’ businesses operate to industry security standards.

This blog post was originally published May 2020 and was updated for comprehensiveness.