What does a certificate do?
Two things. It lets the browser and the server agree on an encryption key, so what passes between them (passwords, card numbers, the pages themselves) cannot be read in transit. And it ties the server’s key to the domain name, so the browser can tell it has reached the real example.com rather than a machine pretending to be it. The lock icon means both. “SSL” is the old name; the protocol in use today is TLS, and hosts use the names interchangeably.
What a certificate does not do is tell you anything about who runs the site. A phishing site can have a perfectly valid certificate for its own domain.
How does a free certificate get issued?
Automatically, by proving control of the domain. Let’s Encrypt, a nonprofit certificate authority, describes the aim of its ACME protocol as making it possible to set up an HTTPS server and have it automatically obtain browser-trusted certificates without any human intervention. The server’s software asks for a certificate; the authority answers with a challenge, which Let’s Encrypt describes as a choice between provisioning a DNS record under the domain or provisioning an HTTP resource under a well-known URI on the domain; the software completes it; the authority checks the challenge from multiple network perspectives and issues the certificate. The whole exchange takes seconds.
Let’s Encrypt does not charge a fee for its certificates. Its default certificates are valid for 90 days, and it suggests renewing them every 60; subscribers can opt into six-day certificates. Short lifetimes are deliberate: they limit the damage from a stolen key and force the automation to work.
What do hosts include?
A free certificate on every plan, at all ten hosts we review, per their plan pages read on 13 October 2026. Most name Let’s Encrypt or say “automatic”; Flashcloud states the certificate is issued and renewed automatically; Hosting.com includes a premium certificate on its Max plan and a standard one below. The only differences worth noticing are whether renewal is automatic (it should be) and whether the host supports a wildcard certificate for subdomains, which needs the DNS challenge.
When is a paid certificate worth it?
In three narrow cases. An organisation-validated or extended-validation certificate shows the legal entity in the certificate details, which some procurement rules and some payment providers ask for. A certificate with a warranty pays out if the authority mis-issues it, which some corporate policies require. And a wildcard or multi-domain certificate from a commercial authority can be simpler to manage on a server the host does not automate. For a business site on shared hosting, none of these applies: the free certificate encrypts exactly as well, and browsers no longer display extended validation differently.
What goes wrong, and how do you fix it?
Renewal, almost always. A certificate that expires produces a full-page browser warning and most visitors leave. On shared hosting the host renews automatically; if the warning appears anyway, the usual cause is DNS pointing elsewhere (the HTTP challenge fails because the request goes to another server) or a redirect rule that blocks the well-known path. During a host migration the certificate on the new server may need the domain to resolve there first; our migration article covers the sequencing.
The second common problem is mixed content: a page served over HTTPS that loads an image or script over HTTP. The certificate is fine; the page’s own links are not. A search-replace of http://example.com to https://example.com in the database fixes most of it.