The most useful certificate choice is often a management choice: who obtains it, installs it, renews it and notices when something fails? Start there before comparing product names. A certificate that fits your site and stays deployed reliably is more useful than an impressive description with an unclear renewal process.
Start with the management model
Check whether your host or CDN already offers managed HTTPS for your own domain. Ask what enabling it covers, how renewal works, and whether an origin server needs separate configuration. In that model the provider operates the certificate machinery. Let’s Encrypt’s getting-started documentation explains the difference between provider-managed certificates and running an ACME client yourself.
Self-management makes sense when your environment requires it and someone can maintain the client, validation access, certificate installation and monitoring. Shell access alone is not a renewal plan. Before choosing this route, identify a primary operator and a backup, and make sure the deployment process survives routine hosting and DNS changes.
Write the hostname list first
List every name visitors will actually use, including aliases that redirect elsewhere. For illustration, demo.test and www.demo.test are separate names; these reserved names are examples, not public certificate targets. The certificate’s Subject Alternative Name entries, often called SANs, describe its covered identities. The TLS identity standard explains that representation.
A redirecting HTTPS name still needs a working TLS connection before the browser can receive the redirect. Avoid purchasing or requesting a certificate for only the final destination while overlooking the addresses that lead to it.
Use explicit names when that is easy to manage. A wildcard can be useful for a changing collection of subdomains, but is not a substitute for an inventory. Its scope has limits, and certificate sharing can make ownership harder to track. With Let’s Encrypt, wildcard issuance requires DNS validation; check whether your DNS provider and chosen client support the necessary automation.
Separate certificate cost from operating cost
Free certificates are a real option. Let’s Encrypt issues domain-validated certificates without a certificate fee. Hosts may separately charge for management or related service. Its FAQ describes the certificate offering and support model.
A paid certificate does not inherently give the connection stronger encryption. Connection security depends on the TLS configuration and cryptographic capabilities in use, as MDN’s TLS guidance explains. Evaluate a paid offer for the actual requirement it addresses, such as procurement terms, a support agreement or a specific organizational validation requirement. Ask who requires that feature and what evidence they expect.
Domain validation establishes control of the requested names. Additional organization checks serve a different purpose. Do not treat either as a guarantee that the site’s content or business is safe, and do not assume a higher price fixes a weak deployment process.
Ask questions that reveal the ongoing work
- Coverage: Which hostnames and endpoints are included, and who adds new ones?
- Validation: What access must remain available for future renewals?
- Deployment: Does a renewed certificate reach every server or edge that needs it?
- Support: Who can act during an incident, and what does the agreement actually promise?
- Portability: What changes when you move hosting, DNS or CDN providers?
For DNS validation, review API permissions and credential storage before deciding it is easy to automate. For HTTP validation, check the required public challenge route. The CA’s challenge documentation lists the relevant prerequisites; a provider’s current client documentation should confirm the implementation.
Record a decision you can maintain
Write a short decision note containing the covered names, management owner, renewal method, deployment destination and alert recipient. Record the specific reason for any paid or specialized requirement. If nobody can explain how the certificate will be renewed and served, resolve that before buying or issuing it.
For a typical managed website, the next step is checking the provider’s domain and HTTPS settings. For a self-managed setup, work through the ACME workflow, then document a renewal plan. Revisit the decision when the hosting architecture changes.