A free Let's Encrypt certificate and a paid one encrypt traffic in exactly the same way. They differ in identity validation, warranty, support and price. In 2026 a shared rule also changes: the maximum certificate lifetime is shrinking in steps, so automatic renewal becomes necessary for everyone.
| Criterion | Let's Encrypt | Paid SSL certificate |
|---|---|---|
| Cost | Free | Annual subscription, by type |
| Validation types | DV (domain) only | DV, OV and EV |
| Wildcard | Yes, through the DNS-01 challenge | Yes, usually at a higher price |
| Lifetime in 2026 | 90 days (default profile) | 200 days at most |
| Renewal | Automatic through ACME | Through ACME or manual |
| Financial warranty | No | Yes, depending on the product |
| Support | Community forum | Contractual support from the issuer |
| Company name in the certificate | No | Yes, with OV and EV |
| Revocation checking | CRLs only | CRL, sometimes OCSP too |
In April 2025 the CA/Browser Forum adopted ballot SC-081v3, which shortens the maximum lifetime of public TLS certificates in steps from 398 days. The limit is 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. In parallel, the period during which an issuer may reuse domain validation falls to 10 days in 2029. The rule binds every public issuer, so it covers paid certificates too. A certificate sold 'for one year' is usually delivered as a subscription with several re-issues.
Let's Encrypt issues 90-day certificates in its default 'classic' profile. From 13 May 2026 an optional 'tlsserver' profile issues 45-day certificates. The default profile moves to 64 days on 10 February 2027 and to 45 days on 16 February 2028. A 'shortlived' profile with 6-day certificates also exists. In August 2025 Let's Encrypt switched off its OCSP servers and moved entirely to certificate revocation lists (CRLs), for privacy reasons. On a correctly configured server with automatic renewal, none of this is noticeable.
EV certificates once showed the company name in green next to the address. Google moved that information into the panel behind the padlock from Chrome 77 in September 2019, and Mozilla did the same in Firefox 70 in October 2019. Google's stated reason was that the indicator did not protect users as intended and took up useful space. Today an ordinary visitor sees no difference between DV and EV. EV stays useful only when a contract, a bank or an auditor asks for it explicitly.
A WooCommerce shop on cPanel hosting gets a Let's Encrypt certificate that is issued and renewed automatically, so the owner never touches it. A paid certificate would change nothing customers can see, but it would add a renewal to track and a yearly cost.
A company selling software to public institutions receives a tender specification that asks for an OV certificate, so a paid certificate is contractually required. The team still installs it through ACME if the issuer offers the protocol, because the maximum lifetime is 200 days anyway.
A SaaS that gives every customer a subdomain uses a Let's Encrypt wildcard certificate obtained through the DNS-01 challenge. Renewal runs automatically through the DNS provider's API. Without automation, the 47-day limit of 2029 would mean almost eight manual renewals a year.
No. Google checks that the site uses valid HTTPS, not who issued the certificate or what it cost. A correctly issued Let's Encrypt certificate, with a complete chain and renewed on time, counts the same as a paid DV certificate.
You can buy a one-year subscription, but the certificate issued under it can no longer last more than 200 days from 15 March 2026. The issuer re-issues it during the subscription period. From 2027 the limit drops to 100 days, so manual reinstallation becomes impractical.
Yes. Let's Encrypt issues wildcard certificates, of the form *.example.com, only through the DNS-01 challenge. The ACME client must be able to create a TXT record automatically, usually through the API of your DNS provider.
For almost any site Let's Encrypt encrypts just as well, free; pay only for OV or EV validation, a contractual warranty or vendor support.
