Buying a certificate

Read this first: most people landing here do not need to buy anything. If you want an ordinary certificate for a website, Let’s Encrypt issues one free in about thirty seconds and renews it for you forever. Browsers treat it identically to a paid one — there is no padlock you are missing out on. This page is for the cases where that genuinely does not work.

When buying is actually the answer

Certificates by brand

Six certificate authorities, all sold through The SSL Store. Every link lands on that product’s own page, where the live price, the warranty and the term options are shown.

About the prices: figures below are indicative only, checked against The SSL Store on 4 August 2026. Each is the lowest per-year rate, which is what you pay on a three-year term — a one-year order costs noticeably more per year, and promotional pricing changes without warning. A dash means we have not verified a figure for that product rather than that it is unavailable. Treat every number here as a rough guide and the product page as the only price that counts. Product names and validation levels were checked on the same date; certificate authorities rename and retire products without notice.

• 
• 
• 
• 
• 
• 

The premium end, and the CA that absorbed Symantec’s certificate business in 2017. Priced accordingly; picked when a procurement list names it.

Comodo CA renamed, and the volume leader by issuance. The usual answer when something demands OV or EV and nobody has specified which CA.

The retail line still sold under the old Comodo name, issued by Sectigo. PositiveSSL and InstantSSL live here — the cheapest paid certificates on the page, and the ones Let’s Encrypt most directly replaces.

A DigiCert brand since the Symantec acquisition, positioned below DigiCert’s own line. TrueBusinessID is the recognisable name.

Also DigiCert-owned now. One of the oldest names in the business, which occasionally matters to a procurement department and never to a browser.

DV only, and the clearest case of a product Let’s Encrypt has made hard to justify. Listed because a wildcard you cannot automate is still a wildcard you have to buy.

Disclosure: every product link on this page is an affiliate link. If you buy through one we are paid a commission, at no extra cost to you. That is the entire commercial arrangement — no CA paid for its position, the brand order is by market share, and the advice above is the same advice we would give with no programme at all. The links set no cookie on this site; any tracking happens on The SSL Store’s own domain, after you leave. Nothing about your visit here is shared with them. The prices, warranties and validation requirements that bind are whatever The SSL Store shows at the time you click, not what is printed above.

Before you order

Buying is the short part. What follows takes longer, and getting the CSR wrong means starting validation over.

• Choosing between DV, OV and EV — the decision in more detail, including the parts that no longer matter.
• Generate the key and CSR — in your browser; the private key never reaches this server. Get the SAN list right here and validation goes smoothly.
• The manual issuance walkthrough — submitting the CSR, completing validation, collecting the chain.
• Installing it — and checking what your server actually serves afterwards, which catches the missing intermediate your own browser hides.