Is a free SSL certificate less secure than a paid one?

Not as far as encryption goes. The certificate type changes how the owner's identity is validated, not the strength of the cipher used on the connection.

Does Let's Encrypt issue OV or EV certificates?

No. According to its official FAQ, it issues only DV (Domain Validation) certificates and has no plans to offer OV or EV.

Do I need a paid certificate to accept payments?

Not necessarily. A DV certificate protects the connection in the same way. The requirement usually comes from your payment processor, a contract or a compliance standard, so check that document.

Do you need to pay for an SSL certificate?

Q: How long does a paid SSL certificate last?

Less than a year. The CA/Browser Forum has been cutting the maximum validity in stages: on March 15, 2026 the cap dropped to 200 days, and the schedule includes further cuts. One-year certificates no longer exist; check the current cap in the CA/Browser Forum schedule.

The question comes up as soon as you register a domain: the registrar's dashboard offers an SSL certificate for a yearly fee, while the tutorial you just read says you can get one without paying. Both are true, and the difference between them is not the encryption. If you don't yet know what a certificate does, start with what SSL/TLS is.

What changes between a paid and a free certificate?#

The cipher used on the connection is negotiated between browser and server and does not depend on what you paid for the certificate. What changes is what the certificate authority (CA) checks before signing, and what comes bundled with it:

Identity validation: free certificates are DV, which only confirm control of the domain. Paid ones can be OV or EV, with checks on the organization.
Financial warranty: some paid CAs offer a warranty in case of mis-issuance. Read each one's terms, because amounts and conditions vary.
Support: human help with issuance and installation problems.
Automation: free certificates are built for automatic renewal over ACME. Paid ones can be automated too, but many are still issued through a web form.

What are DV, OV and EV certificates?#

	DV	OV	EV
What the CA validates	Control of the domain	Domain and the organization (legal name, type, address)	Domain and stricter checks on the organization
Organization details in the certificate	None	Yes	Yes
Issuance	Automatic, in minutes	Depends on manual vetting	Depends on manual vetting, more extensive
Free option	Yes	None among the free CAs cited here	None among the free CAs cited here

According to DigiCert, the difference between the types lies in identity validation. Let's Encrypt, for example, issues only DV and does not plan to offer OV or EV.

In practice, the organization details sit in the certificate's detail view, which almost no visitor opens. Paying for OV or EV just to "look trustworthy" to ordinary users returns little.

Who offers free certificates?#

Let's Encrypt: a nonprofit CA that does not charge for certificates. It issues wildcards, but only with the DNS-01 challenge. See how Let's Encrypt works.
Cloudflare Universal SSL: public certificates issued and renewed at no cost for domains active on Cloudflare, on every plan. On a full setup it covers the root domain and first-level subdomains (example.com, www.example.com); deeper levels need Total TLS or an advanced certificate.
Hosting providers and control panels: many integrate Let's Encrypt or another CA and issue certificates for you. The certificate itself costs nothing, but the provider may charge an administrative fee, as the Let's Encrypt FAQ itself notes.

These terms change over time. Check each provider's page before you decide.

How long does a paid certificate last?#

Much less than it used to. The CA/Browser Forum, which sets the rules for public CAs, has been cutting the maximum validity in stages. On March 15, 2026 the cap dropped to 200 days, and the schedule includes further cuts in the following years. Check the dates and the current cap in the CA/Browser Forum requirements.

In practice, the "1-year certificate" is gone, and a paid certificate also has to be renewed several times a year. If renewal is manual, the real cost includes your time and the risk of forgetting a date. With DV, ACME renewal removes the manual work.

How do you estimate the real cost of a certificate?#

Add the price, the human time and the cost of a failure:

yearly cost = certificate price
            + (renewals per year × minutes per renewal × value of a minute)
            + (chance of forgetting × cost of downtime)

The numbers below are hypothetical, chosen to keep the math easy. They are not any certificate authority's prices; swap in your own.

Hypothetical example: a paid certificate at US$ 300 per year, valid for 200 days, needs at least 2 renewals per year. If each manual renewal takes 30 minutes and your hour is worth US$ 20, that is US$ 300 + 2 × 0.5 × US$ 20 = US$ 320 per year, before counting the risk of forgetting. The same site with automatic DV over ACME costs the initial setup time and little after that.

When is it worth paying?#

Pay when one of these applies:

Contract or compliance requirement: a contract, an audit or a payment processor asks for OV or EV. Check the wording of the requirement.
Organization details in the certificate: you need the company name to appear in it.
Contracted warranty or support: your operation wants a support channel and a warranty for mis-issuance.
Legacy client or device: an old system that only trusts a specific CA.

If none of these applies, automatic DV covers what a site, an API or a bot with a web panel needs. For any type, good practice is the same: automatic renewal and monitoring of the expiry date. If something goes wrong, see SSL certificate errors.

How to do this on Square Cloud#

On Square Cloud, automatic TLS is included on every plan, and the certificate renews on its own. Every web application gets a *.squareweb.app subdomain with HTTPS, with no certificate for you to issue or renew.

To use your own domain, from the Standard plan up, you create the DNS records the dashboard shows at your registrar and follow the validation status in real time. TLS for the custom domain is automatic too, and the domain stays registered in your name at your registrar.

The automatic certificate is DV. If a contract or a compliance standard formally requires OV or EV, it does not meet that requirement.

For the step-by-step, see how to use a custom domain and the domains page.