Free SSL: How to Install Let's Encrypt and ZeroSSL (2026 Guide)

TL;DR

• ✔ cPanel user → AutoSSL (Security > SSL/TLS Status)
• ✔ Plesk user → Let's Encrypt extension (SSL/TLS Certificates)
• ✔ VPS admin → Certbot + Let's Encrypt
• ✔ No panel / manual control → ZeroSSL
• ✔ E-commerce or corporate brand → Paid SSL
• ✔ Multiple subdomains → Wildcard SSL

In this guide, you'll learn:

• What free SSL is, and how Let's Encrypt and ZeroSSL compare
• How to set up free SSL automatically via cPanel AutoSSL or Plesk's Let's Encrypt extension
• How to get a certificate from ZeroSSL and upload it to cPanel or Plesk manually
• Why SSL certificate lifetimes are getting shorter — and what that means for you

Need a paid SSL, a Wildcard, or OV/EV certificate? Browse SSL Certificates.

Need to secure your site today?

Browse SSL Certificates

What Is Free SSL? Quick Answer

This guide is for:

• ✓ WordPress users
• ✓ cPanel users
• ✓ Plesk users
• ✓ VPS administrators
• ✓ Anyone looking for free SSL
• ✓ Anyone considering Wildcard SSL

Free SSL is a security certificate that encrypts the connection between your website and its visitors, available at no cost. The two most common sources are Let's Encrypt and ZeroSSL. On most hosting panels (cPanel, Plesk), these certificates can be installed and renewed automatically; you can also get one manually and upload it yourself.

How SSL Works: The Short Version

Can SSL Be Set Up in 5 Minutes?

Yes, in most cases.

• cPanel AutoSSL: A few clicks, usually done in 1–2 minutes.
• Plesk Let's Encrypt extension: Fill in a couple of fields, hit Install — 1–2 minutes.
• ZeroSSL (manual): Account setup, domain verification, and upload included — around 10–15 minutes.
• Certbot (VPS): Running the command and completing verification — around 5–10 minutes.

30-Second Decision Guide

• Using cPanel hosting: Check AutoSSL first — in most cases, there's nothing to do manually.
• Using Plesk: Use the Let's Encrypt extension — a few clicks and it's set up automatically.
• No panel, or want manual control: Get a certificate from ZeroSSL and upload it.
• Managing a VPS: Set up Let's Encrypt with Certbot and configure automatic renewal.
• Need Wildcard, OV, or EV: A paid SSL certificate is the right tool for those needs.

What Is Let's Encrypt?

Let's Encrypt is a free, automated, open Certificate Authority run by the Internet Security Research Group (ISRG). It's been issuing free SSL/TLS certificates to millions of sites since 2016. Certificates are issued through the ACME protocol using an “ACME client” — either your panel's built-in integration (like cPanel AutoSSL or the Plesk extension) or a standalone tool like Certbot. Let's Encrypt's own recommendation is to use an automated client rather than handling certificates manually.

What Is ZeroSSL?

ZeroSSL is another certificate provider offering both free (90-day) and paid SSL certificates. Unlike Let's Encrypt, ZeroSSL has a web dashboard where you can generate a CSR and private key, complete domain verification, and download the certificate files to upload wherever you need them — which makes it a practical option for anyone who wants manual control or whose panel doesn't have a built-in free SSL integration.

Let's Encrypt vs. ZeroSSL: Side-by-Side

Free SSL on cPanel (AutoSSL)

cPanel's AutoSSL feature requests, installs, and renews free SSL certificates for your domains automatically — no manual steps needed. Depending on your provider's setup, it uses Let's Encrypt or a similar free certificate authority.

• 1.Log in to cPanel.
• 2.Go to SSL/TLS Status under the Security section.
• 3.Check the AutoSSL status next to your domain; if it's active, your certificate is being managed automatically.
• 4.If it isn't active or needs refreshing, click Run AutoSSL.

Is AutoSSL Active on Your Account?

Whether AutoSSL is turned on by default depends on how your hosting provider has configured their environment. If you don't see it or it appears disabled, contact your host's support team and ask them to enable it.

Free SSL on Plesk (Let's Encrypt Extension)

Plesk has an official Let's Encrypt integration that installs your certificate in a few clicks and handles renewals automatically when the time comes.

• 1.Log in to Plesk.
• 2.Go to Websites & Domains and select the relevant domain.
• 3.Open SSL/TLS Certificates.
• 4.Click “Get a free certificate from Let's Encrypt” (or look for “Install a free basic certificate provided by Let's Encrypt” at the bottom of the page).
• 5.Fill in the required email and www/non-www options, then click Install. Plesk tracks renewal automatically from here.

Getting a Certificate from ZeroSSL (Manual Method)

If your panel doesn't offer a built-in free SSL option, or you prefer manual control, ZeroSSL lets you get a certificate through its web dashboard.

Step 1: Create a ZeroSSL Account

• 1.Go to the ZeroSSL website.
• 2.Click Sign Up to create an account, or Log In if you already have one.

Step 2: Request a New Certificate

• 1.Once logged in, click New Certificate.
• 2.Enter the domain you want to secure and click Next Step.
• 3.Select the free 90-day SSL option.
• 4.On the CSR and private key step, enter your domain name, company name, country, and email. Download the generated CSR and private key files and store them somewhere safe.

Step 3: Verify Domain Control

• 1.Choose a verification method: email, DNS, or file upload.
• 2.Complete verification using whichever method works best for you.

Step 4: Download Your Certificate

• 1.Once verification is complete, ZeroSSL gives you a CRT (certificate) file and your private key. Download both.

Uploading a ZeroSSL Certificate to cPanel

• 1.Log in to cPanel.
• 2.Go to SSL/TLS under Security.
• 3.Under Certificates (CRT), click Upload a New Certificate and upload the CRT file from ZeroSSL.
• 4.Under Private Keys (KEY), upload your private key file.
• 5.Go to Manage SSL Sites, select your domain, fill in the CRT, CSR, and private key fields, then click Install Certificate.

Uploading a ZeroSSL Certificate to Plesk

• 1.Log in to Plesk and select the relevant domain.
• 2.Open SSL/TLS Certificates and click Add SSL/TLS Certificate.
• 3.Give the certificate a name, then paste or upload the CRT, CSR, and private key content from ZeroSSL.
• 4.Save, then go to your domain's settings and select Secure with SSL/TLS Certificate, choosing the one you just uploaded.

Let's Encrypt on a VPS with Certbot

If you manage your own server without cPanel or Plesk, Certbot is one of the most widely recommended ACME clients for Let's Encrypt — it's what Let's Encrypt points most users toward when they need to set things up themselves.

# Install Certbot (Ubuntu/Debian example; adjust for your distribution)
sudo apt update
sudo apt install certbot python3-certbot-nginx
 
# Get a certificate and auto-configure Nginx
sudo certbot --nginx -d yoursite.com -d www.yoursite.com
 
# Test automatic renewal
sudo certbot renew --dry-run

If you're running Apache, use the python3-certbot-apache package and the --apache flag instead. Certbot typically adds a scheduled job (cron or systemd timer) during installation to handle automatic renewal; it's worth verifying that this job is actually running with certbot renew --dry-run periodically.

2026–2029: Why Certificate Lifetimes Are Getting Shorter

This isn't just a Let's Encrypt change — it's an industry-wide mandate. The CA/Browser Forum (the consortium of browsers and certificate authorities that sets the rules) has voted to shorten the maximum lifetime for all publicly trusted TLS certificates, paid or free. That rule is already in effect:

Let's Encrypt is moving faster than the broader industry: since May 13, 2026, opt-in users can already get 45-day certificates; the classic (90-day) profile will shrink to 64 days in February 2027, and to 45 days in February 2028.

What This Means for You

As lifetimes get shorter, renewing certificates manually (downloading a new one from ZeroSSL and re-uploading it every cycle, for example) becomes a more frequent chore. This applies to paid certificates too, not just free ones. Let's Encrypt's guidance is to use an automated client (cPanel AutoSSL, the Plesk extension, or Certbot) rather than renewing by hand. Using an ACME Renewal Information (ARI)-aware client means renewals happen at the right time based on the certificate's actual expiry, rather than on a fixed schedule.

After SSL Is Installed: What to Check

• HTTPS redirect: set up a rule (in your .htaccess or panel settings) that sends all http:// requests to https://.
• Mixed content: check whether any images, scripts, or stylesheets on your pages are still loading over http://.
• SSL Checker: verify the certificate is installed correctly and has no chain errors using an online SSL checker tool.
• Renewal monitoring: even with automatic renewal set up, check that it actually ran correctly during the first couple of cycles.
• CAA record (optional, advanced): add a DNS CAA record to limit which certificate authorities are allowed to issue certificates for your domain.

Free SSL vs. Paid SSL

Free SSL is usually enough for a personal blog or small informational site. For e-commerce, finance, or an established brand, OV/EV validation, wildcard coverage, and direct technical support often make a paid certificate the better call.

Which SSL Is Right for You?

If you're not sure, start with your hosting panel's built-in free SSL option. You can always move to a paid certificate as your needs grow.

Common Mistakes

• Not setting up HTTPS redirect after installing: the site stays accessible on both http and https, which creates inconsistency for SEO and security.
• Losing or sharing the private key: the private key is the foundation of your certificate's security; if it's lost you'll need to start over, and if it's shared you've created a security risk.
• Forgetting to renew manually: especially common with ZeroSSL certificates — when 90 days are up, browsers will show security warnings.
• Not covering both www and non-www: make sure the certificate is valid for both versions of your domain.
• Ignoring mixed content: even with SSL installed, pages loading http:// resources can still trigger browser warnings.
• Manually uploading a certificate when AutoSSL or the Plesk extension is already active: this can create conflicts or confusion between certificates.

Frequently Asked Questions

What is free SSL?

Free SSL is a security certificate that encrypts the connection between your website and its visitors, available at no cost. Let's Encrypt and ZeroSSL are the two most widely used sources.

Is Let's Encrypt really free?

Yes. Let's Encrypt is a fully free, automated, open Certificate Authority available to anyone.

Is ZeroSSL free?

ZeroSSL offers a free 90-day plan; it also has paid plans with longer validity and additional features.

What's the difference between Let's Encrypt and ZeroSSL?

Let's Encrypt typically works through a panel integration or ACME client automatically; ZeroSSL offers a web dashboard for manual certificate generation and upload. Both issue DV-level certificates for free.

How do I set up free SSL in cPanel?

cPanel's AutoSSL feature, found under Security > SSL/TLS Status, automatically requests and installs free SSL for your domains. In most cases, no manual action is needed.

How do I set up free SSL in Plesk?

In Plesk, go to Websites & Domains > SSL/TLS Certificates and click Get a free certificate from Let's Encrypt. The extension handles installation and renewal automatically.

How do I set up HTTPS redirect after installing SSL?

Use the automatic redirect option in your panel's SSL settings, or add a redirect rule to your .htaccess file to send all http:// requests to https://.

What's the difference between free SSL and paid SSL?

Free SSL is usually DV-only (domain validation); paid SSL adds OV/EV validation, longer validity options (subject to the same industry-wide caps), wildcard support, and direct technical support.

Can I get Wildcard SSL for free?

Let's Encrypt technically supports wildcard certificates, but they require DNS-based verification and panel/ACME client support. For a simpler and more reliable wildcard solution, a paid wildcard certificate is usually the better option.

Why do SSL certificates only last 90 days?

Let's Encrypt keeps lifetimes short to reduce the impact of compromised keys. The industry as a whole is also moving in this direction: the CA/Browser Forum has mandated that all publicly trusted certificates max out at 200 days as of March 2026, with further reductions through 2029.

Should I renew manually or automatically?

Automatic renewal (via AutoSSL, the Plesk extension, or Certbot) is strongly recommended. As lifetimes get shorter, manual renewal becomes a more frequent and error-prone process.

Why isn't AutoSSL showing up in my cPanel?

Whether AutoSSL is enabled by default depends on your hosting provider's configuration. If you don't see it, contact your host's support team.

What is Certbot?

Certbot is one of the most widely recommended ACME clients for Let's Encrypt, particularly for VPS and self-managed servers where you need to handle certificate issuance and renewal yourself.

Can a website run without SSL?

Yes, but browsers will show a “Not Secure” warning, which undermines visitor trust and may negatively affect search engine visibility.

Is free SSL enough for an e-commerce site?

Technically, free SSL encrypts the connection just as well; however, for e-commerce, a paid OV or DV certificate with direct support and a stronger trust signal is often preferred.

When should I choose OV SSL?

When you want your company's identity verified and included in the certificate — giving visitors an extra layer of corporate trust.

Who should use Wildcard SSL?

Anyone securing multiple subdomains (e.g., blog.yoursite.com, store.yoursite.com) with a single certificate. It's more cost-effective than buying a separate certificate for each subdomain.

Can I get installation support for SSL?

Yes. For paid SSL certificates at Atak Domain, the support team provides free installation assistance. For free certificates, setup documentation is available in the knowledge base.

What should I do in Google Search Console after installing SSL?

Add your https:// site as a separate property in Search Console, update your sitemap, and confirm that redirects from http:// are working correctly.

How do I check whether my SSL certificate is installed correctly?

Click the padlock in your browser's address bar, or use an online SSL checker tool to verify validity, chain completeness, and expiry.

Does Google require SSL?

Google doesn't technically require SSL, but since 2018 Chrome has marked http:// pages as “Not Secure,” and Google has confirmed that HTTPS is a ranking signal — so in practice, not having SSL puts you at a significant disadvantage.

Is SSL a ranking factor for SEO?

Yes, it's a confirmed (though lightweight) Google ranking signal. The bigger SEO impact is indirect: browsers warn users away from non-HTTPS sites, which increases bounce rates and reduces engagement — both of which affect search performance over time.

Can SSL improve my SEO?

Switching from http to https can provide a small direct ranking boost, but the more meaningful gains come from improved user trust, lower bounce rates, and being able to use modern browser features (like HTTP/2) that require HTTPS.

Do I need SSL for my WordPress site?

Yes. WordPress itself will work without SSL, but your visitors will see browser security warnings, and many WordPress plugins and payment gateways require HTTPS. Most hosting plans now include free SSL via AutoSSL or Let's Encrypt.

Can I use free SSL forever?

Yes, as long as you keep renewing it. Let's Encrypt and ZeroSSL certificates need to be renewed every 90 days (a cycle that will shorten over time); with automated renewal set up correctly, this continues indefinitely at no cost.

People Also Ask

Can I use free SSL forever?

Yes — as long as you keep renewing it. Automated renewal (via AutoSSL, Plesk, or Certbot) handles this for you.

Why does SSL expire?

Short lifetimes limit the damage if a private key is compromised. The CA/Browser Forum is making this even shorter: 200 days max from March 2026, 100 days from 2027, 47 days from 2029.

How often does Let's Encrypt renew?

Let's Encrypt certificates are currently valid for 90 days. Certbot and most panel integrations are configured to attempt renewal when around 30 days remain.

Does ZeroSSL renew automatically?

Not by default on the free plan. You can set up ACME-based automation, but out of the box, ZeroSSL free certificates need to be renewed and re-uploaded manually every 90 days.

Is DV SSL secure enough?

For most websites, yes. DV SSL fully encrypts the connection — the same encryption used by OV and EV. The difference is identity verification: OV/EV also confirm who operates the site, which matters more for e-commerce and financial services.

Can I move an SSL certificate to another server?

Yes, if you have the certificate file and private key. Keep both in a safe place during and after installation — the private key in particular can't be recovered if lost.

Related Resources

• Free SSL for Your Website: Installation Guide for cPanel and Plesk
• SSL Checker — Verify Your Certificate Instantly
• CSR Decoder
• SSL Certificates — All Types
• Wildcard SSL Certificates
• DV SSL Certificates
• Multi-Domain SAN SSL Certificates
• cPanel Hosting (Free SSL Included)
• Plesk Hosting (Free SSL Included)
• What Is Web Hosting? (Blog)

Why Not Just Use Paid SSL?

When a visitor lands on your site, your sending address and security setup shape their first impression. A padlock in the address bar is now the minimum expectation — but for an e-commerce store, a financial service, or an established brand, the certificate type matters too.

• DV SSL secures the connection but doesn't verify who you are.
• OV SSL verifies your organization's identity, which shows up in the certificate details.
• EV SSL goes further — extended verification, often used for payment systems and high-trust environments.
• Wildcard SSL covers all your subdomains under a single certificate.

Conclusion

Installing free SSL is largely automatic for most users today: cPanel's AutoSSL and Plesk's Let's Encrypt extension handle the heavy lifting. ZeroSSL's manual method is still a solid option when you need direct control or your panel doesn't have a built-in integration. With certificate lifetimes getting shorter across the industry — the 200-day cap is already in effect as of March 2026 — moving to an automated renewal method sooner rather than later will save you time and reduce the risk of an expired certificate taking your site offline.