A free certificate and a five-hundred-pound one encrypt with the same algorithms and produce the same padlock. The difference is what the issuer verified before signing, and how much they will pay you if they got it wrong.

The three levels

  • DV, domain validated. Proves you control the domain. Issued in seconds, free from Let's Encrypt, and what almost every site on the internet uses.
  • OV, organisation validated. Adds a check that the company exists. Takes days and appears only in the certificate details, which nobody opens.
  • EV, extended validation. A deeper company check. It used to turn the address bar green; browsers removed that years ago, so it is now invisible.
No browser shows OV or EV differently from DV any more. If you are buying one for the visual effect, there is no longer a visual effect.

When paid is genuinely right

  • A wildcard for many subdomains where automating DNS validation is not practical.
  • A warranty a contract requires.
  • A device or a system that only trusts a particular issuer.

The real difference is renewal

A free certificate lasts 90 days and renews itself. A paid one lasts a year and someone has to remember. In practice more sites break from a forgotten annual renewal than from anything a free certificate does.

certbot renew --dry-run
EGPHP issues and renews a free certificate for every domain automatically. Unless something specific requires otherwise, that is the whole of what a site needs.