Any browser will encrypt a connection. What separates certificates is who verified you, how much of your domain is covered, and what the certificate authority pays out if it goes wrong. Pick on those three, not on price alone.
This is the real choice. Everything else — key length, browser support, the padlock — is identical across all three.
Blogs, personal sites, internal tools, anything without a checkout.
The authority confirms one thing: that you control the domain. Nobody checks who you are, so the certificate says the connection is private but makes no claim about the company behind it.
Issued in minutesCompany sites, client portals, anywhere a visitor types real data.
The authority verifies your organisation exists in an official registry and that the domain belongs to it. Your legal company name is written into the certificate, so anyone inspecting it sees a verified entity rather than a domain.
Issued in 1–3 business daysStores, banking, payments — anywhere the visitor is asked for money.
The strictest audit an authority performs: legal existence, physical address, operational status and a callback on a verified number. It carries the highest warranty and is what fraud teams look for when assessing a site.
Issued in 3–7 business daysValidation is who you are. Coverage is what the certificate protects — and buying the wrong shape is the most common and most expensive mistake.
One hostname, plus its www form. The right choice when everything lives on one address and always will.
example.com + www.example.com
Every subdomain of one domain — including ones you have not created yet. Buy this the moment you can name a second subdomain.
*.example.com
Several completely different domains on one certificate and one renewal date. Cheaper and far easier to keep track of than separate certificates.
example.com + example.net + brand.io
Regardless of which authority issues it or what you paid.
For a blog or a brochure site, you should not — the included certificate encrypts exactly as well. You buy a certificate when you need something the free one cannot give: your verified company name inside the certificate, wildcard or multi-domain coverage, a financial warranty, or the EV audit that fraud teams look for. If none of those apply to you, keep the free one.
No. Search engines care that you are on HTTPS, not which certificate you used, and the encryption speed is identical. Anyone selling you SSL on a ranking promise is selling the wrong thing.
It is the certificate authority insuring your visitors, not you: if the authority mis-issues a certificate and someone loses money as a result, the warranty is what covers them. It is a signal of how seriously the authority takes its own verification — treat it as a quality indicator rather than a product you will ever claim on.
Yes. You receive the certificate files and the private key, and they work on any server anywhere. We install it for free on Hostrena hosting; elsewhere you install it yourself, and support will talk you through it if the panel is unfamiliar.
Browsers show a full-page warning and most visitors leave, so nothing about an expiry is quiet. We warn you well ahead of the date, renew automatically where the certificate type permits it, and for OV and EV tell you exactly when to start the re-validation so there is no gap.
Wildcard if the extra names are subdomains of one domain (shop.example.com, api.example.com). Multi-domain if they are genuinely different domains (example.com and example.net). If you need both at once, a multi-domain certificate can carry wildcard entries — ask support and we will size it for you.
Tell us what the site does and who it serves, and we will name the certificate — including telling you when the free one is genuinely enough.
Pick a topic and the assistant will answer from Hostrena's own documentation.
Answers come from an AI assistant and can be wrong. A human is one tap away.
Pick a department and you will be connected to a person straight away.
No support department is available right now. Please try the contact form.