Free TLS Is Now a Realistic Option

Getting a CA-signed certificate used to cost as much as the domain it protected, and the issuance process was error-prone enough that many sites simply skipped encryption. That era is ending. Browsers are actively pressuring sites to move to HTTPS — Chrome plans to flag unencrypted pages, and Firefox will call out login forms served over plain HTTP. Meanwhile, SNI support has become widespread enough that hosts can offer TLS termination without requiring a dedicated IP per customer. The result: there is no longer a good reason to run a public site without encryption.

Below is a rundown of the main free options, what each does well, and where they fall short.

CloudFlare

CloudFlare is best known as a CDN, but it also acts as a certificate issuer and TLS terminator. For anyone hosting content on a service that already supports secure termination — Heroku, GitHub Pages, and the like — CloudFlare is a quick way to put a custom domain in front of it. You also get the CDN benefits at no cost.

What works well:

  • It is extremely easy to enable. If your DNS is already with CloudFlare, you add a record, point it at your origin, and flip the cloud icon to route traffic through their edge.
  • Certificate renewal is automatic. You do not have to track expiration dates or worry about an ops person missing a renewal and serving users a red error page.

What to watch out for:

  • CloudFlare's certificates are not portable. They only exist inside CloudFlare's infrastructure, so you cannot export them for use elsewhere. For most people that is fine, but it is a lock-in consideration.
  • The default "flexible mode" lets the origin serve plain HTTP while CloudFlare terminates HTTPS. This is still better than no TLS, but it means users can unknowingly run an insecure setup.

One more note: CloudFlare's shared certificates rely on SNI. Browser support is now above 97 percent globally, so this only matters if you need to serve clients on very old software.

Let's Encrypt

Let's Encrypt is a free certificate authority run by the Internet Security Research Group (ISRG), with a mission to make certificates available openly and transparently. Much of the recent downward pressure on certificate pricing can be traced to its work.

What works well:

  • It is the most flexible option here: Let's Encrypt issues a certificate along with the private key, so you can take it to any service you want.
  • The tooling for common web servers like Nginx and Apache is mature and well documented.
  • It is built around the ACME protocol, a standardized way to verify domain ownership and issue certificates. That protocol is designed to cut down on user error and further commoditize certificate issuance.
  • Let's Encrypt is a Linux Foundation collaboration project with no commercial agenda, which is more than you can say for some of the other players.

What to watch out for:

  • Wildcard certificates are not on the near-term roadmap. However, the API makes automation easy enough that this is less of a pain point than it would be with a manual issuer.

AWS Certificate Manager

AWS Certificate Manager (ACM) is the newest entrant, and it fills a gap for people building secure services on Amazon. ACM is AWS-only — you manage it through the AWS console or API — and it plugs directly into CloudFront and Elastic Load Balancer.

What works well:

  • ACM issues free wildcard certificates, something no other provider on this list currently offers. That may not matter much if certificates are free anyway, but it saves you from minting a new certificate for every domain you spin up — handy for microservices-style setups on AWS.
  • Renewal is automatic, just like CloudFlare's. That kind of peace of mind is valuable, and here it is included.
  • It finally gives a cheap way to serve static sites from S3 with TLS. Create a bucket, request a certificate in ACM, set up a CloudFront distribution, and link them together.

What to watch out for:

  • As with CloudFlare, ACM certificates cannot be exported. This only becomes a problem if you want to move off AWS, but it is worth knowing up front.

StartSSL: A Historical Note

StartSSL deserves an honorable mention as the original free issuer. It was around for years and operated as a full CA, with an easy upgrade path to products like EV certificates if you needed them. The downside was that issuance was a fully manual process — someone had to walk through it periodically to keep services live. Worse, their control panel relied on a client certificate login system, and the issuance flow was long and opaque enough that only more experienced users could navigate it safely.

For the record, StartSSL is no longer issuing certificates. A series of questionable practices led to its root certificates being revoked from Chrome and Firefox. It is included here only for historical context.

Choosing the Right Free Certificate

A simple rule of thumb covers most cases:

  • On AWS? Use ACM.
  • Hosting on a platform that already offers secure termination, like Heroku or GitHub Pages? Use CloudFlare.
  • Otherwise? Use Let's Encrypt.

The original author of this guide, for example, runs his site on Heroku with the domain terminated at CloudFront, which then fetches content over HTTPS from his Heroku address.

The point is that the free tier is no longer a compromise. Between these three services, virtually anyone can get a CA-signed certificate that is automatically renewed and properly configured — no reason to leave a site on plain HTTP.