To get a free SSL certificate, check your hosting dashboard first: most hosts issue a free Let's Encrypt certificate automatically through cPanel's AutoSSL or their own SSL setting, usually in one click. If you manage your own server, use the Certbot client to get a Let's Encrypt certificate and renew it on a schedule. If your site sits behind Cloudflare, its Universal SSL certificate is free on every plan. All three are trusted by every major browser.
Whichever route you take, renewal has to be automatic, because free certificates are short-lived and getting shorter: Let's Encrypt's default lifetime drops from 90 to 64 days in February 2027. Below you'll find step-by-step instructions for each route, how to choose between them, and how to confirm the certificate works with our free SSL checker.
Key takeaways
- Let's Encrypt certificates are free and trusted by every major browser, and most hosts install them through cPanel AutoSSL.
- Free Domain Validated certificates give the same encryption as paid ones, which is all most small business sites need.
- On your own server, use Certbot and run certbot renew --dry-run to confirm automatic renewal works.
- With Cloudflare, use Full (strict) mode rather than Flexible so traffic to your origin server is also encrypted.
Is a free SSL certificate as secure as a paid one?
Yes, for encryption. A free Let's Encrypt certificate and an expensive paid certificate both use the same TLS protocol and key strengths, and browsers treat them identically. The difference is validation: free certificates are Domain Validated (DV), proving only that you control the domain. Paid Organisation Validated (OV) and Extended Validation (EV) certificates also check the company, but browsers no longer display that information prominently, so for most small business sites DV is all you need.
What you pay for with a commercial certificate is usually support, warranties or a specific compliance requirement, not better security.
Which free SSL option should I use?
| Your setup | Best free option | Who renews it |
|---|---|---|
| Shared or reseller hosting with cPanel | AutoSSL (Let's Encrypt by default) | Your host, automatically |
| Managed WordPress or website builder | Built-in SSL in the host's dashboard | Your host, automatically |
| VPS or dedicated server you control | Let's Encrypt via Certbot | A scheduled Certbot job |
| Site proxied through Cloudflare | Universal SSL at the edge, plus a certificate on your origin | Cloudflare, plus your host or Certbot |
Start by checking whether your host already does it. Let's Encrypt itself says that "for many people, their hosting provider will get and manage certificates from Let's Encrypt for them".
How do I get a free SSL certificate in cPanel?
Most shared hosting uses cPanel, where AutoSSL issues and renews certificates for you. Let's Encrypt is the default AutoSSL provider on new cPanel installations, though your host can configure a different provider.
- Make sure your domain's DNS points to your hosting account. AutoSSL only includes domains and subdomains that pass a domain control validation (DCV) test.
- Log in to cPanel and open Security > SSL/TLS Status.
- Check that your domain and
wwwversion are listed and not marked Excluded. - Click Run AutoSSL. Issuance usually completes within a few minutes.
- Refresh the page. Each domain should now show an "AutoSSL DV Certificate".
If a domain shows "Has AutoSSL Problems", the most common causes are DNS not pointing to the server, a CAA record that doesn't allow the issuing CA, or a .htaccess rule blocking the validation file. cPanel notes AutoSSL renews Let's Encrypt certificates once they are within 29 days of expiry.
How do I get a Let's Encrypt certificate with Certbot?
On a VPS where you have shell access and sudo, Certbot is the client Let's Encrypt recommends "for most people". On Ubuntu or Debian with Nginx:
sudo apt update
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com
For Apache, install python3-certbot-apache and use --apache. Certbot proves you control the domain, fetches the certificate, edits your server config and can add an HTTP-to-HTTPS redirect.
Then confirm renewal works:
sudo certbot renew --dry-run
systemctl list-timers | grep certbot
The packaged versions install a systemd timer or cron job that runs twice a day and renews anything close to expiry. Test against Let's Encrypt's staging environment while experimenting: production allows only five certificates for the exact same set of names every seven days, and 50 certificates per registered domain each week.
If your DNS is with a provider that has an API, the DNS-01 challenge (certbot certonly --dns-<provider>) lets you get wildcard certificates such as *.example.com.
How do I get free SSL with Cloudflare?
Cloudflare issues a free Universal SSL certificate to every domain that is added and active on its network, on Free, Pro, Business and Enterprise plans. It covers the root domain and first-level subdomains like www.
- Add your site to Cloudflare and change your nameservers at your registrar.
- Make sure the DNS records for your site are proxied (orange cloud).
- Wait for the zone to become active; Universal SSL is issued after that.
- Under SSL/TLS > Overview, use Full (strict) if your origin has a valid certificate.
That last step matters. Universal SSL only encrypts the hop between visitors and Cloudflare. In Flexible mode, Cloudflare talks to your server over plain HTTP, which leaves the second half of the journey unencrypted and often causes redirect loops. Cloudflare "strongly recommends using Full or Full (strict)". Get a free certificate on your origin too, from AutoSSL, Certbot or a Cloudflare Origin CA certificate (trusted only by Cloudflare, not by browsers directly).
How long does a free SSL certificate last?
Let's Encrypt's default certificates currently last 90 days, but that is changing. Let's Encrypt scheduled 64-day certificates in its staging environment from October 14, 2026 so you can test, and 64 days becomes the default for every certificate issued or renewed from February 10, 2027. It plans a further cut to 45 days in 2028, and already offers an optional 45-day profile. Our news post on Let's Encrypt 64-day certificates explains how to test your renewals before the switch.
Separately, industry rules capped all publicly trusted certificates at 200 days from March 2026, falling to 100 days in March 2027 and 47 days in 2029, so paid certificates are getting shorter too. Our guide to SSL certificate lifetime changes covers that timetable.
The practical point: renewal must be automatic, and it should not rely on a fixed number of days before expiry. Let's Encrypt stopped sending expiry reminder emails in June 2025, so nothing will warn you if a renewal job silently breaks. Our guide to automating SSL certificate renewal shows how to set it up and test it.
How do I check the certificate is working?
Visit your site at https:// for both the bare domain and www, then check the issuer, expiry date and chain. MakeItFlow has a free SSL checker that shows all three. If a browser shows a warning instead, our guide to SSL certificate errors explains what each message means.
Once HTTPS works, finish the job: redirect every HTTP URL to HTTPS so visitors always land on the secure version, fix any mixed content warnings, and consider adding HSTS once everything is stable.
What to do next
Check your hosting dashboard first, because there is a good chance free SSL is one click away. If you run your own server, install Certbot and run a dry-run renewal today. Then set up independent expiry monitoring so a broken renewal is caught weeks before visitors see a warning; a scheduled MakeItFlow scan on a paid plan re-checks the certificate and emails you the results.
Frequently asked questions
Where can I get a free SSL certificate?
From Let's Encrypt, a nonprofit certificate authority, either through your web host (cPanel AutoSSL or a built-in SSL toggle) or with the Certbot client on your own server. Cloudflare also provides a free Universal SSL certificate for sites that use its proxy. Paid certificates are only needed for specific validation or support requirements.
How long does it take to get an SSL certificate?
With AutoSSL, Certbot or Cloudflare, a free Domain Validated certificate is usually issued within minutes once your DNS points to the right place. Cloudflare's Universal SSL is issued after the zone becomes active. Paid OV and EV certificates take longer because the certificate authority checks your organization.
Will a free SSL certificate affect my Google rankings?
Google has used HTTPS as a light ranking signal since 2014, and it makes no distinction between free and paid certificates. What matters is that HTTPS works everywhere and redirects are clean.
Can I use a free SSL certificate on an online shop?
Yes. DV certificates provide the same encryption a shop needs. If you take card payments through a provider such as Stripe or PayPal, the card details are handled on their systems, and PCI DSS requirements focus on how your site handles data, not on the certificate type.
Does Let's Encrypt issue wildcard certificates?
Yes, but only through the DNS-01 challenge, which means adding a TXT record to your DNS. Automate it with a DNS provider plugin so renewals don't need manual changes.
Why did AutoSSL skip my domain?
Usually DNS doesn't point to the server, the domain is excluded in SSL/TLS Status, or a CAA record blocks the CA. Fix the cause, then click Run AutoSSL again. Our CAA records guide shows how to allow the right CA.
Do I need a separate certificate for email?
Your mail server needs a certificate for the hostname clients connect to, such as mail.example.com. On cPanel hosting, AutoSSL usually covers the mail. subdomain too; check it is listed in SSL/TLS Status.
Related reading
- What Is a Web Application Firewall and Do I Need One?: A web application firewall (WAF) blocks malicious requests such as SQL injection and bad bots before they reach your site. See if you need one and free options.
Sources
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above and this guide was last reviewed on 30 October 2026 . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
