Wetlook World Forum

SSL certificates range all the way from expensive down to free. SAN certificates (that cover two or more separate domains or hosts) are pricey, but a standard single-host domain validation certificate (that simply proves that you are on the site you think you are) is cheap. (The job of a certificate is really to ensure that you are on the site you think you are, which combines your trust in the operating system vendor and the integrity of your computer along with a reputable agency to affirm the reliability of the identity the site presents to you. Once you are past this stage, you then establish a secure connection. Self-signed certificates still give you a secure connection, but it could be to anyone anywhere.)

However, with an industry-standard Let’s Encrypt, the certificate is free and the renewal is automated, so if your hosting provider offers that (as mine does) it is simply a matter of ticking a box to enable HTTPS, and job done, no further cost. Whether Let’s Encrypt is a valid and trustworthy service could be a matter of debate, but it’s industry-standard and ticks the boxes as far as Google is concerned.

The more expensive certificates get you increased levels of organisational validation, where the certification authority validates that the certificate request itself was authorised to the genuine company. For many businesses, this is not necessary, but this service increases trust level in businesses likely to be impersonated, such as banks and merchant services. (These used to be the green bar certificates, but browsers have redesigned the way trust level is presented in recent years too many times to keep track of.)

I’ve been dealing with SSL certificates for years, and standard ones have always been cheap in all my dealings with them — I think the idea that they are expensive is either a misconception, or a reflection of years past.

Personally, my site runs non-HTTP mostly, because I don’t want to suggest that there is anything that eavesdroppers could take (I don’t even set cookies, and there is no tracking or analytics). However, HTTPS is active and some circumstances I advertise links as HTTPS just to offer a bit of reassurance. Google still returns my site in search results despite it being non-HTTPS. It’s very specialist though, so I have no competitors to fight against; I can see being HTTP-only being a problem in the commercial space, but this is a hobby site.