Toolchain Check
Hosting with free SSL — Issuing the certificate is the easy half — fitting it is where sites lose time
You have noticed rivals charging annually for a basic certificate, which is a fair thing to be annoyed about — but the fee is not the interesting part, because a badly fitted free certificate costs you round trips on every visit.
The short answer
A provider that issues a certificate on every plan unprompted and fits it properly — installed with a single HTTPS redirect, the full chain served, renewal automated — holding paid certificates back for the genuine wildcard and organisation-validation cases.
Since automated certificate authorities arrived, charging for basic domain validation has been pure margin: machines request, validate, install and renew on a schedule with no human involved. So judge providers on the fitting, which is the part that still varies.
By the HostingFast team · Reviewed 24 August 2026
Free
Migration in, at no cost
24/7
Humans answering, any hour
Daily
Backups, every day
$0
Setup fees
Every serious host now includes SSL, which makes the free-certificate question settled and slightly boring. What is not settled is the configuration around it, and that configuration has measurable consequences.
HTTP/2 and HTTP/3 both require TLS, so the certificate is also the gateway to the protocol improvements that matter most on a mobile connection. A site that is technically encrypted but badly configured pays for the encryption and collects none of the benefit.
Count the redirects, because each one is a round trip
The classic misconfiguration is a chain: http://example.com to https://example.com to https://www.example.com. Three requests where one would do, and every visitor pays for all of them.
Check it with curl -sIL against the bare http URL and count the 301s that come back. You want exactly one, landing directly on the canonical hostname.
The cost is not theoretical. Each extra hop is a full round trip, which from London is 5–15 ms for a UK visitor and 130–150 ms from the US west coast. On a mobile connection it is worse.
Check the chain, the renewal and the protocol
An incomplete certificate chain is the fault that works in your browser and fails in someone else's, because desktop browsers often cache intermediates and mobile clients and API consumers do not. Any public SSL checker will tell you in seconds whether the intermediate is being served.
Renewal should be automatic and silent. A certificate here is issued as soon as a site is added to the account and renews itself indefinitely afterwards, well ahead of expiry, so it never becomes an item on anyone's list.
Then confirm the modern protocol stack is actually on. HTTP/3 support comes with the LiteSpeed server here, and the browser's network panel will show you the protocol column per request — it is worth looking once rather than assuming.
Coverage, and when a paid certificate is genuinely the answer
Free issuance should cover every domain and subdomain on the account, not just the one printed on the invoice. If a provider issues for the primary and leaves the subdomains to you, that is a fitting failure dressed as a feature.
Encryption-wise, a free DV certificate is identical to a paid one — the cryptography does not change with the price. Money buys wildcard coverage, organisation validation or a warranty, which are procurement features rather than a stronger lock.
There are two real cases. A Wildcard certificate at $169.99 a year covers every subdomain from one certificate, which is what you want when an application creates subdomains on the fly. An EV certificate at $379.99 a year writes a verified company name into the certificate. Both are stocked; neither is pushed.
Verify the fitting on any host, ours included
Run curl -sIL against a site the provider already hosts and count the redirects. Check the chain with a public checker. Look at the protocol column in the network panel. Three minutes, and you know more than the feature list would ever tell you.
Then the usual supplier checks: renewal figure against order figure, refund terms in full, and the registration — HostingFast is a trading name of Vitalcare at Home Ltd, registered in England and Wales, on the public record.
Why the fee is the least interesting part
Charging for a domain-validated certificate is a junk fee, and saying so takes one sentence. The rest of this page is about the configuration, because that is where sites actually lose milliseconds.
The rate you sign up at is the rate you renew at, so year two costs exactly what year one did.
- One redirect to the canonical host, not three
- Full chain served, checked with a public tool
- Renewal automated and silent
- Renewal at the order price, stated in writing
Why HostingFast
Standard on every plan
Issued automatically on every plan
The certificate appears as soon as a site is added to the account, without a request, a ticket or a fee.
Fitted with the redirect in place
HTTPS forwarding is on by default, so visitors are not paying for a chain of hops to reach the canonical hostname.
Renewal that never lapses
Automatic reissue well ahead of expiry, which removes the single most common cause of a sudden browser warning.
HTTP/3 with the LiteSpeed server
The modern protocol stack comes with the web server, and the browser's network panel will confirm it per request.
Paid options stocked, never pushed
Wildcard at $169.99 a year and EV at $379.99 a year exist for the cases that need them, and are not sold to the cases that do not.
A named legal entity
Vitalcare at Home Ltd, registered in England and Wales — the check worth running on anyone terminating your TLS.
Quick Start
From order to online
- 1
Count the redirects with one command
curl -sIL against the bare http address. One 301 landing on the canonical hostname is right; three is a chain you are billing every visitor for.
- 2
Test the chain with a public checker
An incomplete intermediate works in your desktop browser and fails on a phone or in an API client. Thirty seconds settles it.
- 3
Confirm the protocol in the network panel
Add the protocol column and reload. HTTP/2 or HTTP/3 means the certificate is buying you something beyond the padlock.
Built In
Loaded onto every plan
- Free SSL issued automatically on every plan and every subdomain on the account
- Automatic renewal well ahead of expiry, with no ticket to raise
- HTTPS redirect configured by default, landing on the canonical hostname
- Full certificate chain served, so mobile clients and API consumers validate too
- HTTP/3 support with the LiteSpeed web server
- Wildcard SSL at $169.99 a year when an app creates subdomains on the fly
- EV SSL at $379.99 a year when a verified company name is genuinely required
- Certificate installation handled by our team at no charge on the paid products
- NVMe SSD storage behind a LiteSpeed cache on every tier
- Renewal charged at the order rate, printed on the plan page
Frequently Asked
What people ask us most often
How do I check my HTTPS redirect is not a chain?
Run curl -sIL against the bare http address and count the 301 responses. You want exactly one, landing directly on the canonical hostname. Chains like http to https to https-with-www are common, and every extra hop is a full round trip that every visitor pays for on every cold visit.
Does a free certificate encrypt as well as a paid one?
Identically. The cryptography is the same either way. Money buys wildcard coverage, organisation validation or a warranty, which are procurement features rather than a stronger lock. For the overwhelming majority of sites the free domain-validated certificate finishes the job completely.
Why does my certificate work on desktop and fail on a phone?
Almost always an incomplete chain. Desktop browsers frequently cache intermediate certificates from other sites and paper over the gap; mobile clients and API consumers do not. Any public SSL checker will tell you within seconds whether the intermediate is being served, and it is a server-side fix.
When is a paid certificate actually worth buying?
Two cases. A wildcard, at $169.99 a year here, when your application creates subdomains on the fly and issuing per-subdomain is impractical. An EV certificate, at $379.99 a year, when a verified company name inside the certificate is a procurement requirement. Outside those, the free one is the right answer.
Keep reading
API Backend Hosting
Serving JSON to your own apps and third parties, judged on latency and rate limiting.
Hosting for High-Traffic Blogs
How to read a cache hit ratio, and which requests really reach PHP during a surge.
SSL Validation Levels (DV, OV, EV) (Glossary)
What DV, OV and EV actually verify, and which of them a browser ever shows a visitor.
SSL Certificates
Certificates issued and renewed automatically, with wildcard and EV available when scope demands it.
VPS Hosting
KVM virtual servers for when you would rather terminate TLS yourself and pick the cipher list.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Encrypted, and fitted properly.
Certificates issued and renewed automatically, one clean redirect, HTTP/3 with LiteSpeed, and a flat renewal figure.
View SSL Certificates plans