Your host wants $90/year for SSL. Let's Encrypt is free. What you need to know.

What an SSL certificate actually proves

Three validation levels:

• DV (Domain Validation) — the issuing CA verified that you control the domain (via DNS or HTTP challenge). Proves: "you control example.com." Free from Let's Encrypt, ZeroSSL, Buypass.
• OV (Organization Validation) — the CA verified you control the domain and that a registered organization exists matching the cert's details. Proves: "Acme Inc., a real business, controls example.com." Paid, typically $50–$300/year.
• EV (Extended Validation) — stricter organization verification. Historically triggered a green address bar (browsers retired that UI in 2019). Proves: "Acme Inc., and we did deeper checks." Paid, typically $150–$600/year.

Every modern browser shows the same lock icon for all three. The EV green bar is gone. For end users, there is no visible difference.

What browsers care about: is the certificate valid, unexpired, and issued by a CA in the browser's trust store? Let's Encrypt certs satisfy all three. A $99 GoDaddy DV cert satisfies the same three. There is no hidden "better encryption" on paid certs — the ciphers are set by the TLS version, not the cert.

Paid vs free: what you're buying

Free Let's Encrypt certs are valid for 90 days; auto-renewal (built into every modern web host and into tools like certbot, acme.sh, and caddy) handles this transparently. "90-day validity" is not a downside — it is automatic.

Hosts that block Let's Encrypt

Documented cases of hosts actively making the free option harder than necessary:

• Bluehost (historical): Let's Encrypt auto-SSL was "coming soon" for over 18 months while they sold $89.99 Comodo certs. Eventually added, but buried in the dashboard. r/Wordpress thread.
• GoDaddy Managed WordPress: Until 2022, refused to install Let's Encrypt on managed WP; customers had to upgrade to a paid tier to get any SSL.
• HostGator Baby plan: The cPanel AutoSSL (which uses Comodo, not Let's Encrypt) was default; Let's Encrypt required support ticket escalation.
• Network Solutions: Still does not offer Let's Encrypt on shared hosting as of 2026. Paid SSL addon starts at $56/year.

The business logic is explicit: if the host cross-sells their own SSL product, they lose $50–$90/domain/year in margin by making the free option one-click.

When paid SSL actually makes sense

Three scenarios where paid makes sense. These are narrow.

1. Organization Validation required by a customer or regulator. Some enterprise procurement teams require OV certs by policy. If one of your customers mandates it, buy the cheapest OV cert that satisfies them — usually $50–$100/year from SSLs.com or similar reseller.
2. Wildcard with SLA. Let's Encrypt supports wildcards via DNS-01 challenge (free). If your organization needs a wildcard with a support SLA ("we promise to revoke within 24h on request"), a paid cert from DigiCert or Sectigo makes sense. This is rare for non-enterprise.
3. Warranty coverage. Paid SSL includes a warranty ($10k–$1.75M depending on tier) against issuance error. If a CA mis-issues, the warranty pays the affected party. In practice, Let's Encrypt has not had a consequential mis-issuance; the warranty is marketing.

For 99% of sites, Let's Encrypt is strictly the right choice. Fewer moving parts, zero cost, identical browser behavior.

How we handle SSL at LaunchPad Host

Every domain pointed at our nameservers gets a Let's Encrypt certificate issued automatically on site creation, renewed 30 days before expiry, deployed via ACME DNS-01 or HTTP-01 depending on config. Wildcards included.

For customers who need OV or EV, we proxy purchases through a CA partner at cost (our markup is $0). You pay the CA's validation fee directly; we handle installation. No bundled "SSL addon" on our plan page, no sell-side margin.

HSTS is opt-in per site (with preload support). DNS-CAA records are automatic — preventing any CA other than the authorized ones from issuing for your domain.