Should a website use a free or paid TLS certificate?
For most public websites and APIs, Wavesteam recommends an automatically renewed free domain-validation certificate. Pay for organization validation, extended validation, dedicated support, or a managed certificate only when a contract, procurement policy, industry rule, compatibility constraint, or operating requirement provides a clear reason. A paid certificate does not inherently use stronger HTTPS encryption.
DV, OV, and EV primarily differ in what the certificate authority verifies before issuance. DV verifies control of a domain. OV and EV also verify an organization and include related identity information in the certificate. Modern browsers generally do not keep an EV company name prominent in the address bar, so a promised universal consumer-trust uplift is not a sound reason to buy one.
| Option | What is verified | Direct certificate price | Main value | When not to choose it |
|---|---|---|---|---|
| Free DV, such as Let's Encrypt | Domain control | No certificate fee | Public trust and automated issuance for most sites and APIs | Automation is impossible or organization validation is contractually required |
| Paid DV | Domain control | Current CA or cloud price | Commercial support, management controls, or a specific bundled service | Payment alone does not strengthen encryption |
| OV | Domain and organization | Depends on domains, SANs, wildcard, and service | Some procurement, audit, or counterparty identity requirements | Little benefit without an organization-validation requirement |
| EV | More extensive organization review | Current CA quotation | An explicit policy or contract requirement | Do not depend on browser display of a company name |
| Private CA | Enterprise trust policy | Platform, HSM, and operating cost | Internal devices, service identity, managed enterprise endpoints | Not trusted by public browsers by default |
Let's Encrypt's certificate lifetime documentation states that its default certificate currently lasts 90 days and describes shorter options. Free does not mean “renew manually and forget”: request, deployment, renewal, failure alerting, and rollback should be automated, with external checks of the certificate actually presented.
Public certificate lifetimes are also becoming shorter. CA/Browser Forum ballot SC-081v3 sets staged maximums of 200 days from March 15, 2026, 100 days in 2027, and 47 days in 2029. A commercial subscription may still bill annually, but the deployed certificate can require much more frequent reissuance. “Pay once a year and stop thinking about it” is no longer an appropriate operating model.
When defining budget, scope, and cost assumptions, also compare What does a domain name and TLS certificate cost each year? and Is pre-contract discovery free, and does accepting a proposal lock us in?; the linked guidance adds context that should be considered in the same decision.
Budget for lifecycle management
Annual cost includes the certificate or managed subscription, domain and SAN coverage, automated deployment, key protection, monitoring, compatibility testing, and incident response. A free certificate replaced manually on many servers can cost more and create more outage risk than a managed service. Mature ACME automation, by contrast, makes the marginal management cost of many DV certificates low.
A wildcard simplifies coverage for one subdomain level but enlarges the impact of a private-key leak. Separate environments and security boundaries should not casually share a key. A SAN certificate centralizes several names but exposes those names in the certificate and increases the blast radius of renewal failure. Domain topology and isolation—not a simplistic price multiple—should decide.
Acceptance should prove one real renewal and hot reload in a test environment, successful handshakes from relevant browsers and API clients, externally observed expiry alerts, least-privilege key storage with rotation and revocation, and a tested emergency reissue path.
Wavesteam first tests whether ACME-based free DV satisfies the product. If procurement requires OV/EV, a commercial SLA is needed, or legacy equipment requires a particular chain, we document that evidence before purchase. The client controls the production account and certificate ownership; we implement deployment, monitoring, recovery, and handover rather than selling an expensive certificate for “brand value.”