SSL certificate cost in 2026: DV, OV, EV or wildcard?

In 2026 a basic DV SSL certificate is free or costs under 10 EUR a year, while OV, EV and wildcard certificates cost from tens to hundreds of euros a year.

This is a buyer's guide, not a definition; for how HTTPS works, see what an SSL certificate is and why a site needs one.

Short answer: what an SSL certificate costs in 2026

Our catalog as of November 2026 (checked on 3 November), EUR excluding VAT: the 1-year price, then the average per year on a 5-year prepay.

• Free DV (Let's Encrypt): 0 EUR; valid for 90 days and renewed automatically.
• Paid DV, one domain: from 9.40 EUR, or 7.52 EUR a year on 5 years (Sectigo PositiveSSL).
• OV, one domain: from 43.75 EUR, or 34.99 EUR a year (Sectigo InstantSSL).
• EV, one domain: from 113.58 EUR, or 90.86 EUR a year (Sectigo PositiveSSL EV).
• Multi-domain DV with 3 names: from 24.87 EUR, or 19.89 EUR a year; each extra name 14.50 EUR a year.
• Wildcard DV: from 104.44 EUR for 1 year (Sectigo), or 82.96 EUR a year on 5 years (RapidSSL).
• ACME subscription: 17.63 EUR per domain a year.

Many sellers, us included, advertise the second figure as the "from" price. It assumes you pay five years upfront, so for a short-lived site compare 1-year prices.

What you are paying for

Encryption is identical on a free certificate and on a 900 EUR one. The price comes from five things:

1. Validation level. DV proves domain control and is automated. For OV and EV, certificate authority (CA) staff check your company in official registries and confirm the order with you, which explains most of the gap between 9.40 and 113.58 EUR.
2. Number of names. A single-domain certificate covers example.com and www.example.com, a multi-domain (SAN) certificate up to 250 names across domains, a wildcard every first-level subdomain of one domain.
3. Brand. At the same OV level, Sectigo InstantSSL costs 43.75 EUR a year and DigiCert Basic OV 301.60 EUR. The premium buys reputation, higher warranties and sometimes the brand a client's policy requires; browsers trust both equally.
4. Term. On Sectigo lines a 5-year prepay is 20% cheaper per year than a 1-year order; on DigiCert group brands (DigiCert, GeoTrust, RapidSSL, Thawte) the discount varies and is often deeper.
5. Your own time. Every reissue has to reach every server using the certificate, and reissues are multiplying. Automation keeps this cost near zero.

Price table by type, as of November 2026

EUR excluding VAT, checked on 3 November 2026; "5 years" is the full amount, paid once. Prices are updated daily.

SAN prices include 3 names (5 on GeoTrust and Thawte). An extra name costs 14.50 EUR a year on the Sectigo SAN (57.98 EUR for 5 years) and 18.30 EUR a year on the ACME subscription (a wildcard entry there costs 97.60 EUR a year). Latvian VAT of 21% is added where it applies.

When free SSL is enough and when it is not

For most websites Let's Encrypt is enough: a blog, company site, shop or API gets the same encryption and padlock as with paid DV, and most hosting panels, ours included, handle it automatically. On your own server you need certbot, acme.sh or a similar client; see our guide to nginx as a reverse proxy with free SSL.

Paying for a certificate makes sense when:

• your company name has to be in the certificate (OV or EV), because a tender, a bank, a payment partner or a client's policy asks for it;
• you need a wildcard but cannot automate DNS: Let's Encrypt issues wildcards only through the DNS-01 challenge, which in practice needs API access to your DNS zone or a delegated _acme-challenge record;
• the system cannot run an ACME client (some appliances, load balancers, older control panels), so every renewal is a manual upload;
• you want a CA warranty, or help with the CSR, validation and installation.

Mind the timeline: Let's Encrypt certificates last 90 days today, 64 days from 10 February 2027 and 45 days from 16 February 2028 (Let's Encrypt announcement). Until 2029 a paid file lives longer (199 days now, about 100 from March 2027), so manual setups need fewer installs; from March 2029 it is 47 days against 45.

DV, OV or EV: who checks what and what visitors see

DV (domain validation). The CA checks domain control by DNS record, HTTP file or email to an admin address; issued in minutes, the certificate holds only the domain name. Email checks are being phased out under CA/Browser Forum rules: discouraged since 15 March 2026, not allowed from 15 March 2028, so plan on DNS or HTTP validation.

OV (organisation validation). The CA also verifies that your company exists and placed the order, which takes 1-3 working days. The company name and country appear in the certificate details.

EV (extended validation). A stricter check of legal existence, address and the authority of the person ordering, taking up to about a week. Browsers used to show the EV company name in the address bar; Chrome 77 moved it behind the padlock (Chromium announcement), and Firefox 70 followed in October 2019 (Mozilla security blog). Visitors now see the same address-bar icon on all three (a padlock, or the site settings icon that replaced it in Chrome 117).

So buy OV or EV when someone actually checks the certificate (a client's procurement, a partner's security review, your own policy), not to impress visitors. EV certificates cannot contain wildcard names, so with EV every hostname is listed by name.

Wildcard or multi-domain (SAN): where the break-even is

A wildcard such as *.example.com covers every first-level subdomain plus the bare example.com on every brand we sell, but not a.b.example.com or other domains. A SAN lists names one by one, up to 250 across any domains; 3 are included (5 on GeoTrust and Thawte) and each extra name is paid, so count www variants separately.

Four subdomains of one domain

Take shop, api, mail and app on example.com. The Sectigo SAN with 4 names costs 24.87 + 14.50 = 39.37 EUR a year, the cheapest wildcard 104.44 EUR. The SAN stays cheaper up to 8 names (97.37 EUR); from 9 names (111.87 EUR) the wildcard wins. On 5-year prices the line is the same: 8 names on the SAN cost 389.36 EUR for the term, the RapidSSL wildcard 414.82 EUR, 9 names on the SAN 447.34 EUR. If subdomains appear every month, take the wildcard anyway: new names need no reissue.

Three separate domains

Take example.com, example.net and example.lv. A wildcard cannot help, since it covers one domain. Three single-domain Sectigo certificates cost 3 × 9.40 = 28.20 EUR a year, and each also covers its www name. A SAN with the three bare names costs 24.87 EUR, but with the www names it needs 6 entries and costs 68.37 EUR. Here a SAN buys one file and one renewal date, not a lower price, and all its names share one private key and are visible in the certificate.

A mail server

Exchange and similar servers need mail.example.com and autodiscover.example.com, plus autodiscover for each extra mail domain. With one extra domain that is 3 names, covered by the base SAN price of 24.87 EUR. A wildcard would cover only the first domain.

Multi-year terms after the 199-day limit

In April 2025 the CA/Browser Forum, where CAs and browser makers set the rules for public certificates, adopted Ballot SC-081v3. The maximum lifetime of a certificate file falls in three steps:

• from 15 March 2026: 200 days (the rules recommend at most 199, the figure in our catalog);
• from 15 March 2027: 100 days;
• from 15 March 2029: 47 days.

DigiCert, which also issues GeoTrust, RapidSSL and Thawte certificates, moved to 199 days early, on 24 February 2026. On the same dates the reuse of a completed domain check shrinks from 200 days to 100 and then 10. OV and EV company details can be reused for 398 days, so on a multi-year OV or EV term your company is re-checked about once a year.

Terms of up to 5 years still exist, but you are buying free reissues for the term, while each file lives at most 199 days. A 5-year order placed in November 2026 means about 30 certificate files, or around 40 if you renew two weeks before each expiry, mostly 47-day files after March 2029 that each need a fresh domain check.

By hand that is slow and easy to get wrong. We offer two ways to automate it:

• The free chssl agent for certificates bought from our catalog. Installed on a Linux server with nginx, Apache or Docker, it puts each reissue in place and reloads the web server. See how the chssl agent works.
• The ACME subscription at 17.63 EUR per domain a year: DV only, with credentials for your own ACME client such as certbot, acme.sh or Caddy. It includes the domain and 1 extra name; further names cost 18.30 EUR a year each and a wildcard entry 97.60 EUR a year, up to 255 names per domain, with wildcards validated through DNS-01.

For an inventory and monitoring checklist, read how to prepare for 199-day certificates.

Questions to ask any SSL seller, us included

• Are reissues free and unlimited within the term? Ours are, for the whole paid term.
• Which CA issues it? RapidSSL, GeoTrust and Thawte are DigiCert brands, and some policies name the CA, not the brand.
• Who installs each reissue? On our hosting we do. On your own server you do, or the chssl agent on Linux.
• Is anything charged automatically? We invoice in EUR and charge nothing automatically.
• How is the domain checked at each reissue? A DNS record or HTTP file placed by automation beats an email someone must click.

Our engineers answer on working days 9:00-17:00 Riga time and help with the CSR, validation and installation.

How to choose in one minute

• Automated renewal possible, no company name needed: free Let's Encrypt.
• Manual installs, or you want help: paid DV from 9.40 EUR a year.
• Company name required in the certificate: OV, or EV only when explicitly demanded.
• Many or changing subdomains of one domain: a wildcard (cheaper than a SAN from 9 names).
• Several domains, or a mail server: a multi-domain SAN certificate.
• Your own ACME tooling across many hosts: the ACME subscription.

Current prices are on the pages for wildcard SSL certificates, multi-domain SAN certificates and SSL automation with ACME; single-domain certificates are in the main SSL catalog. If the choice is unclear, send our support your list of hostnames and we will tell you which option costs less.