Encryption strength is identical across a free certificate and an expensive one. The same algorithms, the same protection in transit. What you pay for is validation, coverage and support — and for many sites, the free option is the correct one.
Three validation levels
Domain Validation. Proves control of the domain. Issued automatically in minutes. This is what free certificate authorities provide, and it delivers the padlock and the encryption. For most business sites it is sufficient.
Organisation Validation. The certificate authority verifies your organisation actually exists — registration records, sometimes a phone call. Takes days. Organisation details appear in the certificate, visible to anyone who inspects it.
Extended Validation. A more rigorous version of the same. Historically browsers displayed the company name prominently in the address bar; they largely no longer do, which removed the main commercial reason people bought EV.
Since browsers stopped displaying EV distinctively, the practical difference for a visitor between DV and EV is close to nothing. Buy OV or EV because a client contract, a sector regulator or a procurement checklist requires it — not because you expect visitors to notice.
Coverage: where cost genuinely varies
- Single domain covers one hostname. Cheapest, and often free.
- Wildcard covers unlimited subdomains at one level. Useful when you run many subdomains, or provision them dynamically per customer.
- Multi-domain covers several distinct domains on one certificate. Convenient for one server hosting several brands, at the cost of coupling their renewals together.
Free authorities issue wildcards too, so this is no longer automatically a reason to pay.
What a warranty actually is
Paid certificates advertise a warranty figure, often a large one. It is worth understanding what it covers: broadly, it protects the relying party — the end user — in narrow circumstances where the certificate authority mis-issued a certificate and someone suffered a loss as a result.
It is not insurance for your business against being breached. Claims are rare and conditions are specific. Treat a large warranty number as marketing rather than as a risk transfer you can rely on.
The case for paying
Legitimate reasons:
- A contract or regulator specifies OV or EV
- You want a longer validity period with fewer renewal events, where the certificate authority offers one
- You need support with a human attached when something breaks
- You want organisation identity embedded for partners who do inspect certificates
- Your infrastructure cannot easily run the automated renewal that free authorities require
That last point is the practical one. Free certificates have short lifetimes and assume automation. Where automation is not feasible, a longer-lived paid certificate can be worth it purely to reduce the number of renewal events that can be forgotten.
Expiry is the real risk
Far more outages are caused by expired certificates than by weak ones. An expired certificate throws a full-page browser warning, and most visitors leave immediately.
Whatever you buy: automate renewal where you can, monitor expiry independently of the renewal process, and alert well ahead — not the day before. Send alerts to a shared mailbox, because the most common cause of an expiry is that the reminder went to someone who left.
Where security budget goes further
If the goal is a more secure site rather than a certificate, the same money usually buys more elsewhere: a web application firewall, tested backups, keeping software updated, access control and two-factor authentication on the systems that matter, and monitoring that tells you when something changes.
A site with an expensive certificate and an unpatched CMS is not secure. It is encrypted.
About the author. Kislay Chandan has worked with schools since 2014. Rather than gathering requirements from the outside, he worked inside a school to see what actually goes wrong day to day, and built what he found into the software. He still works with Shemrock Glitters in Patna — most changes to the product start with something that came up there.
Gallery
