Free SSL certificate options: Let’s Encrypt (90-day, auto-renewed via ACME, the standard for public sites), ZeroSSL (90-day, also ACME-based, alternative CA), and Cloudflare (universal SSL for sites behind Cloudflare’s proxy). The team that uses Let’s Encrypt has free, auto-renewed certs for any public site.
Table of contents
- Let’s Encrypt
- How to get one with certbot
- Auto-renewal
- ZeroSSL
- Cloudflare Universal SSL
- Comparison
- When to use paid CA
- FAQ
Let’s Encrypt
Free, automated, open CA:
- 90-day certs (must auto-renew).
- ACME protocol (HTTP-01, DNS-01 challenges).
- Wildcards supported (DNS-01 only).
- Trusted by all major browsers.
The team that uses Let’s Encrypt has the de facto standard. Certbot, acme.sh, Caddy, and many web servers integrate.
How to get one with certbot
sudo apt install certbot
sudo certbot certonly --nginx -d example.com -d www.example.com
# or for webroot (no downtime)
sudo certbot certonly --webroot -w /var/www/html -d example.comCert lands in /etc/letsencrypt/live/example.com/. The team that uses certbot has standard tooling.
Auto-renewal
Certbot installs a systemd timer:
sudo systemctl status certbot.timer
sudo certbot renew --dry-runRuns twice daily, renews when within 30 days of expiry. The team that has the timer running has zero cert work.
ZeroSSL
Alternative free CA:
- 90-day certs (same as Let’s Encrypt).
- ACME-compatible.
- Web UI for manual cert requests.
- No rate limits for low-volume users.
The team that prefers ZeroSSL has an alternative if Let’s Encrypt is rate-limited or has issues.
Cloudflare Universal SSL
For sites behind Cloudflare’s CDN:
- Free SSL cert from Cloudflare.
- Auto-renewed, no action needed.
- Covers the Cloudflare <-> origin connection (with Full or Full Strict mode).
The team that uses Cloudflare has SSL handled for the visitor->Cloudflare leg. The team that wants origin SSL too uses Cloudflare Origin CA + Let’s Encrypt.
Comparison
| Provider | Cost | Length | Auto-renew | Wildcard |
|---|---|---|---|---|
| Let’s Encrypt | Free | 90 days | Yes (ACME) | Yes (DNS-01) |
| ZeroSSL | Free | 90 days | Yes (ACME) | Yes |
| Cloudflare | Free | 90 days | Yes (auto) | Yes |
| DigiCert | $$-$$$ | 1 year | Manual | Yes |
| Sectigo | $ | 1 year | Manual | Yes |
The team that picks based on automation + cost has Let’s Encrypt for most cases.
When to use paid CA
- EV (Extended Validation) certs (some compliance requires).
- Wildcard with very fast issuance (paid CAs are faster).
- Internal PKI (Windows AD CS, Vault PKI).
- Long validity (paid CAs up to 1 year, EV to 2 years).
The team that needs EV uses paid. The team that needs auto-renew uses Let’s Encrypt.
FAQ
Is Let’s Encrypt really free?
Yes. Operated by ISRG (Internet Security Research Group), a non-profit. Funded by sponsors and donations.
Do all browsers trust Let’s Encrypt?
Yes - Let’s Encrypt root ISICR1 is in all major browser trust stores.
Can I get a wildcard for free?
Yes via Let’s Encrypt DNS-01 challenge. Requires API access to your DNS provider.
How does Let’s Encrypt verify I own the domain?
ACME challenges: HTTP-01 (serve a token on port 80) or DNS-01 (add a TXT record to your DNS). Both prove domain control.
What if my cert expires before renewal?
Renewal failures should be caught by monitoring. Certbot emails the registered address. The team that monitors email + has uptime monitoring catches this.
If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.
Useful related references: