SSL certificates have been free and automatic for years. That has not stopped them being a line item, and the ways it gets charged for are worth recognising.
Free For The First Year
The certificate is included with the introductory term and appears on the renewal invoice as a separate charge. Structurally identical to the renewal price trap, applied to something that costs the provider nothing.
Free On The Primary Domain Only
Included for the main domain, chargeable for each addon domain or subdomain. If you run three sites on one account, you discover this at the point you add the second.
Free To Issue, Manual To Renew
The subtlest version. The certificate is genuinely free, but renewal is not automated, so every ninety days you either remember to click a button or your site starts warning visitors. Some providers then offer automated renewal as a paid upgrade.
Automation is the entire point of free certificates. Selling it back is selling you the thing that was already included.
Paid Certificates That Do Have A Purpose
To be fair: extended validation certificates involve real identity checks, and some sectors require them. Wildcard certificates covering unlimited subdomains can be genuinely convenient. If your bank or your auditor asks for one, buy one.
For an ordinary business website, no. The encryption is identical and visitors cannot tell the difference, because browsers stopped showing the distinction years ago.
The Only Question Worth Asking
Is SSL automatic, on every domain on my account, for as long as I am a customer, at no charge?
Here the answer is yes, including renewals, including addon domains, and we monitor what is actually being served rather than assuming the renewal worked. It is a solved problem and it should be invisible.
