SSL certificates in 2026: free, automatic, and still misconfigured
Certificates are free and renew themselves on modern hosting, yet expired ones still take sites down. What a certificate does, and the four setups that fail.
The short answer
A certificate does two things: it proves to the visitor’s browser that the site they reached really is yours, and it lets the connection be encrypted so nobody in between can read or change it. Certificates are issued for specific names, expire after a set period, and must be renewed. In 2026 all of that is free and automatic on any modern hosting platform.
And yet expired and incomplete certificates still take business websites down every week. Not because certificates are hard, but because of four setups that quietly fail.
The four setups that fail
| Setup | What happens | The fix |
|---|---|---|
| Manual renewal | Someone must remember a date every year or every ninety days. Someone forgets | Move to a platform that renews automatically |
| Names not covered | The certificate covers the bare domain but not www, or not a subdomain added later | Include every name, or use a certificate per subdomain, issued automatically |
| Forgotten subdomain | An old subdomain still points somewhere with an expired certificate, and shows a warning to anyone who finds it | Inventory subdomains; remove or fix each |
| Issuance blocked | A CAA record names a different authority, or a DNS or firewall change stops the automatic check | Fix the record; verify renewal actually succeeded, not just started |
What automatic looks like when it works
On a modern hosting platform, adding a domain triggers issuance, adding a subdomain triggers issuance for it, renewal happens well before expiry, and the whole thing is invisible. There is nothing to buy, nothing to upload, and no calendar reminder. If your hosting still asks you to purchase, generate or install a certificate, that is information about the hosting, not about certificates.
What a certificate does not do
- It does not make the site secure. It secures the connection. A hacked site with a valid certificate is still a hacked site.
- It does not stop the first unencrypted request. That is what HSTS is for.
- It does not verify your business identity to visitors in any way they notice. Browsers stopped highlighting that years ago.
What this means for you
Check three things: whether your certificate renews automatically, whether it covers every name your visitors use including www and subdomains, and whether anyone would be told three weeks before it expires. If any answer is no, fixing it is small work. If your hosting cannot do the first, that is one more reason the hosting is due for a move.
Frequently asked questions
Do I still need to buy an SSL certificate?
For a normal business website, no. Free certificates from automated authorities provide the same encryption and the same padlock, and modern hosting issues and renews them without anyone touching them. Paid certificates exist for specific organisational validation needs, which a business website does not have.
Why did our certificate expire if it renews automatically?
Usually because something blocked the renewal: a DNS change, a CAA record that names a different authority, a firewall rule, or a hosting migration that left the old renewal job behind. Automatic means the platform tries; monitoring means you find out when it fails, weeks before visitors do.
The main site is fine but a subdomain shows a warning. Why?
The certificate covers the names it was issued for. A subdomain added later, such as shop or app, needs to be included or needs its own certificate. On modern platforms this happens when the subdomain is added; on older setups it is a manual step that gets missed.
Does the certificate protect my website from being hacked?
No. It protects the connection between the visitor and the site from being read or altered in transit. It says nothing about the security of the site itself. A hacked site can have a perfect certificate. Both matter; they are different things.
Sources
- Let's Encrypt: documentation (accessed 2026-09-11)
- MDN Web Docs: Transport Layer Security (accessed 2026-09-11)