In this guide · 8 sections
Short answer
For most business websites, a free DV certificate from Let's Encrypt is enough. Encryption strength is identical and browsers no longer show a visible difference. Pay for OV or EV only if a partner, tender or security questionnaire specifically asks for an organisation-validated certificate.
DV, OV and EV certificates: what you pay for
An SSL certificate (more precisely a TLS certificate) does two jobs: it encrypts traffic between the visitor and your site, and it proves the site belongs to the domain name in the address bar. The encryption is the same for every type. What changes is how much the certificate authority (CA) checks about who you are.
DV (Domain Validated)
Free or cheapS$0 with Let's Encrypt
- CA checks only that you control the domain
- Issued in minutes, fully automatic
- Let's Encrypt issues only this type
Best for: Almost every SME website, online shop and booking site.
OV (Organisation Validated)
From US$218/yr at DigiCert
- CA also checks the company's legal existence
- Company name sits in the certificate details
- Manual checks take days
Best for: When a partner or tender asks for it in writing.
EV (Extended Validation)
From US$344/yr at DigiCert
- Strictest company vetting
- No special address-bar display in major browsers
- Most expensive, slowest to issue
Best for: Rarely worth it for an SME.
Prices are DigiCert's list prices for one year, as shown on its certificate comparison page in October 2026. Sectigo says its own certificates start at US$110 a year for single-domain DV. Resellers and hosts often sell the same brands for less.
What visitors see in the browser today
For years, the padlock was sold as a trust signal. That has changed. In 2023 Google replaced the lock icon in Chrome with a neutral 'tune' icon from Chrome 117, because HTTPS had become the default and many people wrongly read the padlock as 'this site is trustworthy'. Chrome still warns loudly when a connection is not secure.
Major browsers also stopped showing the company name next to the address for EV certificates some years ago. A visitor would have to click into the connection details to see any difference between a free DV certificate and a US$995 EV certificate. In practice, almost nobody does.
What visitors do notice is a missing or broken certificate: a full-page warning that most people will not click through. That is a far bigger risk to your business than the type of certificate. Our guide to fixing an expired SSL certificate covers that situation.
The SSL warranty: who it actually protects
Paid certificates are often advertised with a warranty of US$10,000 to US$2 million. It sounds like insurance for your website. It is not.
Claims depend on a CA making a mistake in issuing the certificate, and a visitor losing money as a direct result. That is rare. A higher warranty figure tells you something about the CA's confidence in its checks, but it should not be the reason you choose a certificate.
Shorter certificate lifetimes from 2026
The rules that every public CA follows are set by the CA/Browser Forum. Its Baseline Requirements are cutting the maximum life of a certificate in stages, which affects free and paid certificates equally.
| Certificates issued | Maximum validity | Renewals a year, roughly |
|---|---|---|
| Before 15 March 2026 | 398 days | 1 |
| From 15 March 2026 | 200 days | 2 |
| From 15 March 2027 | 100 days | 4 |
| From 15 March 2029 | 47 days | 8 |
This removes one old argument for paid certificates: 'install it once and forget it for a year'. A paid certificate bought today cannot last more than 200 days. Let's Encrypt already issues 90-day certificates and plans to move to 45 days by 2028, with renewal handled automatically by the hosting software. If your host or developer renews paid certificates by hand, that process will soon need to run several times a year.
When a paid SSL certificate is worth it
There are a few real reasons to pay. Most SMEs will not meet any of them.
Paying makes sense if
- A client, bank or tender document asks in writing for an OV or EV certificate
- You need a certificate on a system that cannot run automatic (ACME) renewal
- You want vendor phone support and a managed renewal service
- Your security team wants the company name inside the certificate
Free is fine if
- You run a normal company site, shop or booking page
- Your host supports Let's Encrypt or another free ACME CA
- Renewal is automatic and monitored
- Nobody has asked you for OV or EV
Before buying OV for a partner, ask what exactly they need. Sometimes a security questionnaire simply asks whether the site uses HTTPS with a valid certificate, which a free one satisfies.
Hosting upsells to watch for
Many Singapore hosting plans list SSL as an add-on. Some charge for a basic DV certificate that the same server could get free. Others bundle a 'premium' certificate with a site seal, malware scan or warranty and a higher renewal price.
Before you pay for SSL
If SSL is a paid extra on every plan, it is worth comparing hosts. Our web hosting cost guide for Singapore lists what is normally included.
Do it yourself or get help?
On most modern hosts, switching to a free certificate is a single toggle in the control panel. Check that renewal is automatic, then add an uptime or certificate monitor that emails you if the site stops loading over HTTPS.
If your site runs on an older server, uses a manually installed certificate, or shows mixed-content warnings after the switch, our Website Security Hardening (S$290) sets up automatic SSL renewal, forces HTTPS, adds security headers and checks the rest of your site's basic security.
Frequently asked questions
Yes. A free Let's Encrypt certificate provides the same encryption as a paid one, and browsers treat it the same way. What matters for a shop is that the certificate is valid, renews automatically and covers every page. Card payments are usually handled by the payment provider's own secure pages anyway.
A domain-validated certificate can cost nothing through Let's Encrypt. Paid certificates vary widely: as of October 2026, DigiCert lists OV from US$218 and EV from US$344 a year, and Sectigo's own DV starts at US$110. Hosts and resellers often charge less for the same brands, so compare renewal prices.
Not in the address bar in major browsers today. The company name is still inside the certificate, but a visitor has to open the connection or certificate details to see it. That is why EV no longer gives the visible trust boost it was once sold on.
Not any more in a meaningful way. Under CA/Browser Forum rules, certificates issued from 15 March 2026 can last at most 200 days, falling to 100 days in March 2027 and 47 days in March 2029. Free Let's Encrypt certificates last 90 days but renew automatically.
It covers visitors who lose money in a transaction because the certificate authority wrongly issued a certificate. It does not cover your business for hacks, data breaches, downtime or an expired certificate. Treat the warranty figure as marketing, not as insurance.