Free or paid certificate
For most sites the free Let’s Encrypt certificate is enough: encryption is just as strong, but it lasts 90 days and must renew automatically (certbot, hosting panel). Paid certificates make sense when you need organisation validation (OV/EV) for banks or public-sector clients, a wildcard without automation, a warranty, or installation on hardware that cannot renew automatically.
To order a certificate you need a CSR, which you can make with our CSR generator.
Common mistakes
- Missing intermediate certificate: the site opens in desktop Chrome but fails on Android and in API clients. Install the full chain (fullchain).
- A certificate for example.com does not cover www.example.com: include both names in SAN, or use a wildcard.
- Auto-renewal broke after a migration: check the expiry monthly or set up alerts.