Frequently asked questions

Basics

What is an SSL certificate and why do I need one?

An SSL certificate (strictly speaking, TLS) lets your site open over https://. It encrypts the connection between the visitor's browser and the server and confirms that the site really runs on that domain. Without it, browsers mark the site as “Not secure”, and data from forms, such as a contact or login form, travels across the internet as plain text. More in our guide to SSL certificates.

Is a free certificate worse than a paid one?

The encryption is the same. A Let's Encrypt certificate confirms control of the domain (DV type), just like the cheapest paid certificates, and works in all popular browsers. Paid OV and EV certificates also check company details, but browsers show the same padlock for them. The difference is validity: a Let's Encrypt certificate has to be renewed about every two months, which is why we send you an email reminder.

How much does it cost?

Nothing. Let's Encrypt issues certificates free of charge, and we do not charge any fees, show ads or sell data. The account is free too.

How long is a certificate valid?

A Let's Encrypt certificate is currently valid for 90 days. Renewing means repeating the same three steps, and we remind you about it by email. Let's Encrypt has announced that validity will be shortened to 64 days from February 2027 and to 45 days from February 2028.

Is a free certificate suitable for an online store?

Yes. Customers see the same padlock as with a paid certificate, and the connection is encrypted in the same way. Card payments are usually handled by the payment provider on its own secure page anyway.

Generator

Is it safe?

Yes. The private key is created in your browser (Web Crypto API) and is never sent anywhere. The certificate is issued by Let's Encrypt, a non-profit certificate authority used by millions of websites around the world. This site is only a tool for talking to Let's Encrypt. Details on the Security page.

Do I need an account?

Yes, but it is free: all you need is an email address and a password. With an account, we keep a history of your certificates (without the private key), remind you by email to renew, and show you the guide for your hosting provider. You can delete your account at any time.

File on the server or DNS record?

A file on the server is simpler if your site already works at an http:// address and you can upload a file to it. A DNS record always works, even for a site that does not exist yet, and it is required for a certificate that covers all subdomains (*.example.com). The two methods are compared on the How it works page.

Can I get a certificate for all subdomains (*.example.com)?

Yes. Enter *.example.com, ideally together with example.com, and choose verification with a DNS record: Let's Encrypt issues wildcard certificates only after verification with a DNS record. The wildcard covers one level, i.e. www.example.com and shop.example.com, but not example.com itself or a.b.example.com.

Will one certificate cover the address with and without www?

Yes, if you enter both names, for example example.com, www.example.com. One certificate can cover up to 10 names. With the “File on the server” method, you then upload a separate file for each name, usually to the same folder.

What is test mode?

Test mode lets you go through the whole process on the Let's Encrypt test environment without using up any limits. A certificate from test mode is not trusted by browsers. Once everything works, repeat the process in production mode. Production mode works for names that passed a test in the last 30 days or already have a production certificate in your account, so you do not need to repeat the test when you renew.

How many certificates can I generate?

Let's Encrypt, which issues the certificates, has its own limits: at most 5 certificates for the same set of names within 7 days, 50 new certificates for one domain together with its subdomains within 7 days (renewals of the same set of names do not count), and 5 failed verifications of one name per hour. On freessl.pl one certificate covers up to 10 names, and you can save up to 30 certificates a day in your account and up to 100 entries in total (test entries disappear automatically after 30 days). Test mode has much higher limits, which is why production mode only works after a successful test. If you hit a limit, the generator tells you in plain language which limit it is and from when you can try again. Details: Let's Encrypt rate limits.

What should I do if domain verification fails?

The generator shows in plain language what Let's Encrypt replied and suggests the most common cause: a file with a different name or in the wrong folder, a redirect to the home page, a missing TXT record or an old record value. Fix the settings and click “Start over”: the new order gets a new file or a new record value. Practice in test mode first, because failed attempts there do not count against the Let's Encrypt production limits.

Installation and renewal

My hosting provider has no option to upload my own certificate

Most panels have such an option, usually in a section called “SSL” or “Security”. We have step-by-step guides for OVHcloud, Hostinger, Plesk, cPanel, DirectAdmin, servers with nginx or Apache, Synology NAS and QNAP NAS. Some hosting providers are exceptions: they install your own certificate only themselves, either as a paid service or after you send a request to their support. If you cannot find such an option in your panel, write to your hosting provider's technical support: sometimes all you need to do is ask them to enable it.

The certificate is installed, but the browser still shows a warning. What should I do?

The error code below the warning tells you what is wrong. Most often the certificate does not cover the address with or without www, the certificate in the panel is the one from test mode, the intermediate certificates are missing, or the server is still showing the old certificate. We explain this on the page “Your connection is not private”. If there is no warning, but the site looks broken or something does not work, it is loading some files over http: see mixed content.

How do I make my site always open over https?

Turn on a 301 redirect from http to https. In cPanel, use the “Force HTTPS Redirect” toggle next to the domain; in DirectAdmin, “Force SSL with https redirect” in the domain settings; on most other hosting, three lines in the .htaccess file are enough. Before you turn it on, check that the site works over https without warnings. Details: redirecting http to https.

What should I do if the certificate has already expired?

Generate a new certificate for the same domains and install it in the same place. Until it is installed, browsers show a warning instead of your site, but nothing else breaks. To avoid this, renew the certificate when our reminder arrives, which is about a month before it expires.

How is freessl.pl different from Certbot and automatic certificates from hosting providers?

Certbot is a program that you install on a server and that renews the certificate by itself. It requires access to the server. Many hosting providers and NAS devices also issue free certificates automatically. freessl.pl is useful where you cannot install anything and the panel does not give your domain an automatic certificate: on shared hosting, on a NAS without an open port 80, or when you need a wildcard certificate. If you have automatic renewal, use it, because it is more convenient.