Buying a Domain With Free SSL: Who Actually Gives You the Certificate

The certificate does not come from whoever sells you the domain. It comes from whoever serves your site, and on any competent host it is free and automatic, which makes most bundled SSL offers a discount on something you were not going to pay for.

This is the single most useful thing to understand before buying anything, because the registrar and the host are separate jobs that are usually sold together, and the bundling is what makes the pricing confusing. Once the split is clear, the decision gets much simpler and usually cheaper.

Table of contents

• The two jobs, and why they are not the same
• Why certificates became free
• What the bundled offers actually include
• What to check before you buy
• Pointing the domain at the site
• The part after the domain
• How this fits the rest of the stack
• FAQ

The two jobs, and why they are not the same

A registrar sells you the right to a name. You pay an annual fee, your name goes into a registry, and you get a control panel where you set DNS records. That is the whole job. A registrar never sees a single request to your website.

A host runs the server that answers those requests. When a browser connects over HTTPS, it is your host that presents the certificate and does the TLS handshake. The certificate lives on the machine terminating the connection.

So the question is not whether the domain comes with SSL. The question is whether whatever is serving your site can get and renew a certificate for that name. Those are different companies unless you deliberately buy both from one place.

This is why the most upvoted answer in every forum thread on the subject is some version of the same sentence: free SSL is controlled by the web host, not the domain registrar. It is correct, and it is the whole article in one line.

Why certificates became free

For most of the web’s history, a certificate was a product you bought from a certificate authority for somewhere between thirty and several hundred dollars a year, with a manual validation process attached.

That changed with the arrival of free, automated certificate authorities and the ACME protocol. ACME lets a server prove it controls a domain by answering a challenge, either by serving a specific file over HTTP or by publishing a specific DNS record. If the challenge passes, a certificate is issued, and the whole exchange takes seconds with no human involved.

Because it is automated, it is also cheap to renew, which is why these certificates are short-lived by design. Ninety days is typical, with renewal attempted well before expiry. That short lifetime is a feature: a compromised key has a much smaller window to be useful.

The practical result is that the certificate is no longer a purchase. It is a background process on the server, and on a modern platform you never see it happen.

What the bundled offers actually include

When a bundle advertises free SSL, it is usually one of these, and they are not equivalent:

• An automated free certificate, provisioned and renewed for you. This is the good case, and it costs the provider almost nothing, which is why it can be given away.
• A one-year promotional certificate from a paid authority, free for the first term. Read the renewal price. This is the offer most likely to become a line item you forgot about.
• A certificate that is free only while you stay on their hosting. Fine while you stay, irrelevant the moment you move.
• A free domain with a paid hosting plan, where the domain renews at full price in year two while the introductory hosting rate also expires.

None of these are scams, but they are priced as bundles for a reason. The thing to compare is the renewal cost of the whole arrangement in year two, not the headline price in year one.

And be clear about what a paid certificate buys. For an ordinary website, an automated free certificate gives browsers exactly the same padlock and the same encryption as a paid one. What you get for money is organisation validation, extended validation, a warranty, and support. Those matter for a bank. They do not matter for a portfolio, a shop, or a startup.

What to check before you buy

The questions that actually determine whether this goes smoothly:

1. Does the host issue and renew certificates automatically for custom domains? If yes, you can buy the domain anywhere.
2. Does it cover subdomains, or only the apex? A certificate for example.com that does not cover www.example.com is a support ticket waiting to happen.
3. Does the registrar let you edit DNS records freely, including A, AAAA, CNAME, TXT and CAA? Some cheap bundles lock DNS to their own hosting.
4. What does the domain renew at? Introductory domain pricing is common and the second year is frequently several times the first.
5. Is transferring out easy? You want the authorisation code available in the panel without a phone call.

If the answer to the first question is yes, the SSL part of the buying decision disappears entirely and you can choose the registrar on price and DNS quality alone.

One thing worth knowing that almost nobody mentions: a CAA record on your domain restricts which certificate authorities are allowed to issue for it. If a CAA record is set and does not include the authority your host uses, issuance fails with an error that looks like a host problem and is actually a DNS problem.

Pointing the domain at the site

Once you own the name, connecting it is a small number of DNS records. For a host that gives you a hostname to point at:

Type   Name    Value
CNAME  www     your-site.example-host.com
A      @       203.0.113.10

The apex of a domain cannot hold a CNAME in standard DNS, which is why the root record is usually an A record, or a provider-specific flattened alias if your DNS host offers one.

Then wait for propagation, which is governed by the TTL on the records you replaced, not by any fixed period. If the old records had a 48 hour TTL, some resolvers will hold them that long. Lowering the TTL a day before a migration is the trick that makes cutovers fast.

Certificate issuance normally happens automatically once the DNS resolves to the host, because that is what makes the ACME challenge pass. If your host shows a certificate as pending, the usual cause is that DNS has not fully propagated yet, or a proxy in front is intercepting the challenge path.

The part after the domain

Buying the name is the easy half, and it is also the half that generates the most shopping advice. The recurring cost of a website is the hosting, not the domain, and that is the number worth understanding before you commit to anything.

For a static site, the cost is mostly bandwidth. For anything with a login or a database, it is a running service plus a database instance. Those are different orders of magnitude, and which one you need is decided by what the site does, not by what it looks like.

For reference on the hosting side: RunxBuild handles custom domains and certificates automatically on every project type, static sites include 120GB of bandwidth then bill at ten cents a gigabyte, and managed WordPress starts at three dollars a month. We do not sell domains, so buy the name wherever the DNS panel and the renewal price suit you, and point it at whatever is serving the site.

How this fits the rest of the stack

The domain is an annual fee you will barely notice. The hosting is a monthly one that scales with what the site actually does, and it is where the real number lives. The RunxBuild hosting calculator breaks that side down into line items, so the service, the database, the storage and the bandwidth each show up separately instead of hiding behind a single introductory price that changes in year two.

Useful related references:

• Free SSL Certificate: Let’s Encrypt, ZeroSSL, and Cloudflare
• Multi-Domain SSL: SAN Certificates, Wildcards, and What to Use
• How to Renew an SSL Certificate: A 2026 Guide
• Custom domains and certificates on RunxBuild

FAQ

Does buying a domain include an SSL certificate?

Not inherently. The certificate is presented by whatever serves your site, so it comes from your host. Registrars sometimes bundle one, but if your host issues certificates automatically, that bundle is a discount on something you would have got free anyway.

Is a free SSL certificate as secure as a paid one?

For an ordinary website, yes. The encryption and the browser padlock are identical. Paid certificates add organisation or extended validation, a warranty, and support, which matter for financial institutions and rarely for anyone else.

Why is my free certificate only valid for 90 days?

Short lifetimes are deliberate. Because issuance and renewal are fully automated, there is no reason for a long validity period, and a shorter one limits the damage if a private key is ever compromised. Renewal happens automatically well before expiry.

Can I buy a domain from one company and host the site somewhere else?

Yes, and it is usually the better arrangement. You point the DNS records at your host and the certificate is issued there. Keeping them separate also makes it much easier to change hosts later without touching the domain.

My certificate will not issue even though DNS is set. What is wrong?

Three usual causes. DNS has not fully propagated, so the validation challenge still resolves to the old target. A proxy in front of the site is intercepting the challenge path. Or a CAA record on the domain does not list the certificate authority your host uses, which blocks issuance outright.