SSL certificates: how Let's Encrypt and paid SSL actually work

People still ask whether a free certificate is as good as a paid one. The short answer: the encryption is identical. What differs is what the certificate authority checked before issuing it, who you call when something breaks, and how much of the renewal work you have to own. In 2026 that last part matters more than it used to.

What a certificate actually does

SSL is the old name. What runs today is TLS, but everyone still says SSL. A certificate is a signed statement that says a specific public key belongs to a specific domain. Your browser does not trust your server directly. It trusts a short list of root authorities baked into the operating system or browser, and it follows a chain of signatures from your certificate up to one of them.

• The browser connects and the server sends its certificate chain.
• The browser checks that the chain ends at a trusted root, that the domain name matches, and that the dates are valid.
• Both sides agree on session keys using the server's key, and the traffic is encrypted from there.
• Any failure produces the full-page warning your visitors will not click through.

How Let's Encrypt issues a certificate

Let's Encrypt is a non-profit certificate authority that issues free certificates through an automated protocol called ACME. A client such as Certbot runs on your server, generates a key, and asks for a certificate. The authority then wants proof that you control the domain, and that is the only thing it checks.

• HTTP-01: the client places a token file at a known path on your site and the authority fetches it. Simple, but it cannot issue wildcards.
• DNS-01: the client adds a TXT record to your DNS. Slower to set up, but it is how you get a wildcard certificate.
• Once validation passes, the certificate is issued in seconds and the client installs it and schedules renewal.

certbot certonly --webroot -w /var/www/html \
  -d example.com -d www.example.com

# test that renewal works before you rely on it
certbot renew --dry-run

Let's Encrypt issues domain-validated certificates only. Nobody checks who you are, only that you control the name.

How paid SSL works

The mechanics are the same, with more paperwork. You generate a private key and a certificate signing request, submit it to a commercial authority or a reseller, complete validation, and download the certificate to install yourself. Paid certificates come in three validation levels.

• DV (domain validated): domain control only, same as Let's Encrypt. Commercial DV mostly buys you support, a warranty, or a longer-lived management dashboard.
• OV (organization validated): the authority also checks that your company exists, and the company name goes into the certificate.
• EV (extended validation): stricter business checks. Browsers used to show a green bar for it and have largely dropped that treatment.
• Wildcard and multi-domain (SAN) variants exist at every level.

Here is the part vendors blur. OV and EV do not encrypt any better than DV. They add identity information you can read by opening the certificate details, and most visitors never do. Treat them as a compliance or procurement requirement, not a security upgrade.

The 2026 twist: lifetimes are shrinking for everyone

Since 15 March 2026 the maximum validity of any publicly trusted certificate, free or paid, is 200 days. The industry schedule drops it to 100 days on 15 March 2027 and 47 days on 15 March 2029. Let's Encrypt still defaults to 90 days today, but it has an opt-in 45-day profile since May 2026, plans a 64-day default from February 2027, and 45 days from February 2028.

The consequence is simple. A paid certificate you install by hand once a year is on its way out. Whether you pay or not, you will need automated renewal, and Let's Encrypt recommends renewing about two thirds of the way through the lifetime rather than at a fixed day count.

Where it bites

• Free is not hands-off. If renewal fails silently, the certificate still expires. Run the dry run and set up expiry monitoring.
• Port 80 and firewall rules break HTTP-01 validation more often than anything else.
• Wildcards need DNS access and an API token for your DNS provider if you want them automated.
• Paid is not safer. A manually installed paid certificate expires just as hard as a free one.
• Check what you are buying. Support, a warranty or an OV name may be worth it for a bank or a B2B portal. A blog does not need them.

What I would pick

For a blog, a portfolio, a small shop or an internal tool, Let's Encrypt with automated renewal. For a business that needs a verified company name in the certificate, vendor support, or a procurement-approved authority, a paid OV certificate, ideally from a vendor that supports ACME so renewal is automated too. In both cases the certificate you can forget about is the good one.

Sites: letsencrypt.org (docs and certificate lifetime plans) and certbot.eff.org (client)