SSL Certificates Explained: Free vs Paid and Fixing HTTPS Errors

For almost every business website, a free SSL certificate from Let's Encrypt or your host gives the same encryption as a paid one, and browsers show the same padlock. Paid certificates add company checks (OV and EV), warranties and support, but Chrome stopped showing the company name in the address bar in 2019, so visitors rarely see the difference. What matters more in 2026 is that certificates now expire much faster, so automatic renewal is essential.

This guide is for owners and managers who are asked to buy a certificate, see a "Not secure" warning, or want to know what their host's SSL actually covers. It also explains the HTTPS errors owners meet most often and how to fix them.

#What an SSL certificate does

An SSL certificate (strictly a TLS certificate today) lets a browser confirm it is talking to your real domain and then encrypt everything sent between them: form entries, logins, card details on a checkout. Without one, browsers mark the site "Not secure".

A certificate is issued by a certificate authority (CA), a company browsers trust to check that you control the domain. Every certificate has an expiry date. When it expires, browsers show a full-page warning and most visitors leave.

#DV, OV and EV: what each one checks

All three types use the same encryption strength. They differ only in what the certificate authority checks before issuing.

The company details in an OV or EV certificate are only visible if a visitor clicks the padlock and opens the certificate details. Chrome moved the EV indicator out of the address bar and into that panel from Chrome 77 in 2019. A paid certificate does not make a site rank higher, load faster or look different to a normal visitor.

#Free certificates: what Let's Encrypt covers

Let's Encrypt is a free, non-profit certificate authority, and it is what most hosts use behind their "free SSL" button. Its FAQ says it issues only DV certificates and has no plans to issue OV or EV. It supports wildcard certificates (such as *.example.com), which must be verified through DNS.

Cloudflare also issues a free DV certificate, called Universal SSL, for sites that use its proxy. It covers the root domain and first-level subdomains such as www.example.com, but not deeper names such as shop.uk.example.com. Our guide to Cloudflare setup for business websites explains how Cloudflare's certificate and your server's certificate work together.

#What paid certificates add, and do not add

Paid certificates can add:

• OV or EV company checks, when a customer, bank or tender asks for them.
• A warranty, which pays out under the CA's own terms if the CA wrongly issues a certificate. Read the terms; it is not insurance for your business.
• Phone or chat support, and help with unusual servers.
• Certificate management tools for organisations with many domains.

They do not add stronger encryption, a search ranking advantage, a different padlock, or a longer life. Since the industry rules apply to every publicly trusted certificate, a paid certificate expires on the same schedule as a free one.

#Certificate lifetimes are getting shorter: 2026 to 2029

In April 2025, the CA/Browser Forum (the body of certificate authorities and browser makers that sets the rules) passed ballot SC-081v3 to cut the maximum lifetime of public TLS certificates in steps. The Baseline Requirements now list these dates:

Let's Encrypt certificates are already shorter: 90 days by default today. Let's Encrypt has announced it will move its default to 64 days on 10 February 2027 and to 45 days on 16 February 2028. Its advice is to renew automatically at about two thirds of a certificate's life, or let the renewal client follow Let's Encrypt's renewal information (called ARI), and not to rely on a fixed 60-day schedule.

What this means for you:

1. Stop renewing by hand. A yearly calendar reminder no longer works when certificates last 200 days now and 47 days by 2029.
2. Check your host renews automatically. Most control panels do. Ask your host if you are not sure.
3. Plan for paid certificates too. If you buy a multi-year paid certificate, you still have to reissue and install it within each lifetime limit. Ask the seller whether they automate that.
4. Add an expiry alert. Let's Encrypt itself advises monitoring in case renewal fails. Our guide to website monitoring tools covers tools that warn you before a certificate expires.

#Fixing mixed content and common HTTPS errors

Most HTTPS problems on a live site come from a handful of causes. Work through them in this order.

#Mixed content

Mixed content means an HTTPS page loads something over plain HTTP. MDN explains that browsers now upgrade HTTP images, audio and video to HTTPS automatically, and block other HTTP resources, including scripts, stylesheets, iframes and web fonts. That is why a page can look broken after moving to HTTPS: a stylesheet or slider script is simply blocked.

The fix, for a WordPress site:

1. Set both the WordPress Address and Site Address to https:// in Settings, General.
2. Replace old http:// links to your own domain in the database with a search-and-replace tool that handles serialised data. Take a backup first.
3. Fix hard-coded http:// links in the theme, page builder settings, widgets and custom code.
4. For third-party files that do not support HTTPS, find another source or remove them.
5. Open the browser's developer console and look for mixed content warnings on key pages, including checkout.

Two shortcuts help but are not a full fix. The upgrade-insecure-requests Content Security Policy header tells browsers to load every resource over HTTPS. Cloudflare's free Automatic HTTPS Rewrites changes HTTP links to HTTPS where the resource is available over HTTPS, but its docs note files loaded by scripts at runtime can still cause warnings.

#When to get help

You can usually handle a free certificate yourself if your host has a one-click SSL button. Get help when the certificate keeps failing to renew, when you see warnings on checkout or login pages, when an HTTPS error appeared after a host move or Cloudflare change, or when a customer or tender asks for OV or EV and you are not sure what to buy.

Our domain, DNS and Cloudflare setup service covers certificates, redirects and Cloudflare SSL modes. If the site is down or showing warnings to customers right now, emergency WordPress fixes is the faster route. For new sites, hosting, domain and email setup includes SSL from day one.