SSL certificates: what one does, how a site gets one free, and the shorter lifetimes from 2026

Google's Chrome help puts it in two sentences: Chrome authenticates and secures HTTPS connections with website certificates, and these certificates encrypt the link between a site and your browser. Let's Encrypt, a free certificate authority, calls them SSL/TLS certificates and says websites use them to enable secure HTTPS connections.

A certificate is issued for a domain name once the certificate authority has checked that whoever is asking controls that domain. In Let's Encrypt's description, the software asking for the certificate proves it, for example by putting a DNS record on the domain or a file at a set address on the site. A certificate says nothing about whether the business behind the site can be trusted: Google's Chrome team wrote in May 2023 that the lock icon does not indicate website trustworthiness.

Let's Encrypt charges no fee for its certificates. Its getting-started guide gives two routes: a hosting provider that gets and manages Let's Encrypt certificates for you, automatically or through a setting you switch on, or an ACME client such as Certbot, which you run yourself if you can run commands on your own server. Its FAQ adds that some hosting providers charge a nominal fee for the work of providing them.

The website builders include one. Shopify provides a free TLS/SSL certificate for domains added to a store, Squarespace says it creates and configures free SSL certificates for all its websites, custom domains included, and WordPress.com lists SSL on every plan. Before paying a host for a certificate, ask whether one comes with the plan; what hosting includes lists the other questions worth asking.

Let's Encrypt issues domain validated certificates only. It says it does not offer organisation or extended validation, mainly because it cannot automate issuing them.

The CA/Browser Forum's Baseline Requirements, the rules for publicly trusted TLS certificates, sort certificates into types by how much they say about the holder. A domain validated certificate names the domain. An organisation validated certificate also carries the organisation's name and location, which the certificate authority must verify. Extended validation certificates follow the Forum's separate Extended Validation Guidelines. The Requirements add a note that every type gives the same assurance of the domain name itself.

In the address bar, Chrome and Firefox show a visitor no difference. Chrome's help says its security symbols indicate whether it has established a secure and private connection with a site, and Chrome from version 77, and Firefox from version 70, released on 22 October 2019, moved the extended validation details out of the address bar.

On a page with no private connection, Chrome shows its "Info or Not secure" symbol, and its help page tells the site owner what fixes it: securing the site and its data with HTTPS.

Chrome 154, released to the stable channel on 22 September 2026, goes further. Its release notes list "Ask before HTTP on by default": Chrome prompts users by default when they connect to a site over an insecure (http) connection. When Google announced the change in October 2025, it said the default would cover public sites, with Chrome asking the user's permission before the first visit to any public site without HTTPS. A visitor can still turn the warnings off, through the setting Chrome calls Always use secure connections.

A page served over HTTPS can still pull in images, scripts or stylesheets over plain HTTP, and Google's guide calls this mixed content. Scripts, stylesheets and iframes are active mixed content, which an attacker can use to take full control of the page. Images, video and audio are passive mixed content, which an attacker can still swap, or use to track which pages a visitor views.

Google's Chrome team wrote in 2019 that Chrome blocks mixed scripts and iframes by default. Google's guide says that in some cases Chrome upgrades passive mixed content to HTTPS: where the item is available over HTTPS, that copy loads, and where it is not, the item does not load. Chrome lists what it found, blocked or upgraded in the Issues tab of its developer tools. The fix is to load everything on the page from an https:// address.

In April 2025 the CA/Browser Forum passed Ballot SC-081v3, which cuts the longest a publicly trusted TLS certificate may be valid in three steps. No member voted against it, and all four certificate consumers that voted, Apple, Google, Microsoft and Mozilla, voted for it. The dates are in section 6.3.2 of the Baseline Requirements, of which version 2.3.1, dated 4 October 2026, is the current one.

Let's Encrypt's certificates are valid for 90 days by default, and it recommends renewing them every 60 days. On 10 February 2027 its default becomes 64 days, and it plans a default of 45 days in 2028.

It was built for that: the stated aim of Let's Encrypt and its ACME protocol is that a server obtains browser-trusted certificates automatically, without any human intervention. For the 2027 change, it says automated renewal through software that supports ACME Renewal Information should need no changes, because that lets Let's Encrypt tell the software when to renew.

None of these needs anything bought. The domain matters as much as the certificate, because a certificate goes to whoever can show control of the domain: registering a .ie domain covers whose name it should be in.