Authorised partner · 10-day money back · Free installation support

Devices & Servers · Web & application servers

Work out which certificate your server actually needs

Without a trusted certificate the browser marks your site Not secure, blocks the features your application needs, and search treats it as a negative signal.

  • Not secure is the first thing a visitor readsChrome labels the site in the address bar before a single line of your page has been read, and it is the one part of your design you cannot restyle.
  • Modern browser features refuse to run without itService workers, geolocation, camera, clipboard and HTTP/2 are all gated behind a trusted certificate. Without one, a good part of your stack simply stops.
  • It has been a ranking signal for a decadeGoogle confirmed HTTPS as a ranking factor in 2014 and Chrome has escalated the warnings every year since. This is table stakes, not an upgrade.
  • One certificate, every node in the fleetInstall the same file on each server behind the load balancer, with free unlimited reissues for the whole term.
  • $14.99for a year, Comodo PositiveSSL...
  • 69% offits list price of $49
  • Minutesdomain validated, issued live
  • Every nodeone file across the fleet

Start with what you are running

The install differs, the certificate does not. Everything below takes the same product in either PEM or PKCS#12 form, and we convert between them free.

What is the site for?

Encryption strength is identical across every option here. Price tracks how thoroughly the authority checks who you are, and how many names you need covered.

1

One site, one server, live today

A brochure site, an internal API, a staging box, a new project. Domain validation is automatic, issuance takes minutes, and the padlock behaves exactly as it does on a certificate costing twenty times more.

Typically: Anything where nobody is going to read the certificate details.

Best for this COMODO

Comodo PositiveSSL Certificate

The cheapest publicly trusted certificate we sell, issued in minutes with no paperwork. Right for the large majority of sites.

  • Domain validated · issued in minutes
  • $10,000 warranty
  • Free unlimited reissues for the whole term
from $14.99 $49 per year, before term discounts
Details
Also fine RAPIDSSL

RapidSSL Certificate

The same coverage on the RapidSSL root, which some hosting panels still list by name.

  • Domain validated · issued in minutes
  • $10,000 warranty
  • Free unlimited reissues for the whole term
from $16.95 $69 per year, before term discounts
Details
2

A business site where your registered name should be visible

Organisation validation means the authority checks your company exists, at the address you claim, and writes that into the certificate. Anyone inspecting it sees a legal entity rather than just a hostname — which is what most B2B security questionnaires are looking for.

Typically: Company websites, customer portals, anything reviewed by a procurement team.

Best for this COMODO

Comodo InstantSSL Pro SSL Certificate

Organisation validated with your company name in the subject and a warranty behind it. One to three working days once documents are in.

  • Organisation validated · issued in 1-3 days
  • $100,000 warranty
  • Free unlimited reissues for the whole term
from $66.93 $89.24 per year, before term discounts
Details
Lower cost OV CERTUM

Certum Trusted SSL Certificate (OV)

The same class of vetting from Certum at a lower price, if the brand on the root is not dictated to you.

  • Organisation validated · issued in 1-3 days
  • $10,000 warranty
from $41.96 $158 per year, before term discounts
Details
3

Checkout, banking, or a login that handles other people’s money

Extended validation is the strictest vetting a certificate authority performs, and carries the largest warranty. Read the note below about the green bar before you buy on that basis — we would rather you knew.

Typically: E-commerce checkouts, payment portals, financial and healthcare logins.

Best value EV CERTUM

Certum Premium EV SSL Certificate

Extended validation with a very large warranty attached, at a price closer to organisation-validated certificates than to most EV products.

  • Extended validation · issued in 7 days
  • 1000000 € warranty
from $129 $299 per year, before term discounts
Details
Comodo EV COMODO

Comodo EV SSL Green Bar Certificate

Extended validation on the Comodo root, if your existing estate or your hosting provider already standardises on it.

  • Extended validation · issued in 1-5 days
  • $1,750,000 warranty
  • Free unlimited reissues for the whole term
from $249 $449 per year, before term discounts
Details
4

One certificate across a fleet, or across many hostnames

Load balancers, blue-green pairs, container fleets and shared hosting all want the same certificate in several places. That is fine — install the same file everywhere. The question is only whether your names sit under one domain or several.

Typically: HAProxy pairs, F5 VIPs, autoscaling groups, panels serving many hostnames.

One domain COMODO

Comodo PositiveSSL Wildcard Certificate

Unlimited subdomains of a single domain, so every service you add under it is already covered. The usual answer for a load-balanced estate.

  • Domain validated · issued in minutes
  • Covers unlimited subdomains of the domain
  • $10,000 warranty
  • Free unlimited reissues for the whole term
from $121.98 $162.64 per year, before term discounts
Details
Several domains COMODO

Comodo PositiveSSL Multi-Domain Certificate

Lists unrelated domains explicitly on one certificate with one renewal date. Starts at three names and takes many more.

  • Domain validated · issued in minutes
  • 3 hostnames included, up to 247 in total
  • $10,000 warranty
  • Free unlimited reissues for the whole term
from $114 $165 per year, before term discounts
Details

Three things that cause most support tickets

Extended validation no longer shows a green bar

Chrome and Firefox removed the company name from the address bar in 2019, and it has not come back. EV still means the strictest identity vetting available and the largest warranty, and the company details are one click away in the certificate viewer — but if the only reason you were buying EV was the green bar, buy organisation validation instead and spend the difference elsewhere. We would rather say so than sell you the wrong thing.

A missing intermediate is the cause of most “it still shows a warning” tickets

Desktop Chrome will often quietly fetch a missing intermediate certificate and hide the problem. Java clients, Tomcat, older Android and most API consumers will not, so the site looks fine to you and broken to your customers. Install the full chain, then confirm it from outside with the SSL Checker.

The certificate has to match the key you generated the request with

If a server refuses to start after the install, this is nearly always why — the certificate was issued against a different signing request from the one whose key is on the server. Our key matcher confirms in seconds whether a certificate, its request and its key belong together.

Questions we get asked about this

How quickly can I be live?

Domain-validated certificates issue in minutes once you answer the validation email or publish the DNS record. Organisation validation takes one to three working days for the company checks, and extended validation one to five. If you need to be live today, start with a domain-validated certificate and upgrade later.

Can I install one certificate on more than one server?

Yes for everything recommended on this page — a load-balanced pair, an autoscaling group or a blue-green deployment all take the same file. Some enterprise ranges elsewhere on the site are licensed per server and state so on their product page.

IIS wants a .pfx and I have a .crt and a .key. Now what?

They are the same certificate in two containers. Convert with a single OpenSSL command, or send us the files and we will return the bundle in whichever format your platform wants.

What is the difference between the cheap and the expensive certificates?

Not the encryption — that is identical. What you pay for is how thoroughly the authority verifies who you are, how much warranty sits behind that check, and how many hostnames the certificate covers.

Something else on the network?

The same certificates cover the rest of the estate. These pages start from the hardware rather than from the certificate.

Send us the hostname list and we will price it up

Tell us what each box is and which names it answers on. We come back with the cheapest combination that genuinely covers the estate — and say so if that is fewer certificates than you were about to buy.

Ask an engineer Have us install it