Transport Notes
Lets encrypt vs paid SSL — TLS is a latency question, and the invoice is not part of it
Something told you a paid certificate is more secure or faster, and nothing you have read so far has shown you a single measurement either way.
The short answer
The certificate does not touch the cryptography: free and paid certificates negotiate the same TLS 1.3 cipher suites over the same code path, so nothing about the price appears anywhere a browser or a benchmark can see it.
What does cost milliseconds is round trips, chain length, session resumption and whether revocation checking is stapled. Take the free automated certificate unless a concrete requirement overrides it — wildcard coverage across subdomains, verified company details in the file, or a procurement policy that names a commercial authority.
By the HostingFast team · Reviewed 24 August 2026
99.9%
Uptime target
24/7
Engineers on call
Free
SSL, every plan
NVMe
Storage class
Certificates get discussed as though they were a security product with tiers, which is how a basic paid certificate ends up on the bill of a small site that gained nothing from it.
The engineering picture is simpler and more useful. A certificate is an identity assertion. The speed of your HTTPS connection is decided by handshake round trips, the size and order of the chain, whether the session can resume, and which protocol version is in play — none of which have a price attached.
The parts of TLS that actually cost time
A fresh TLS 1.3 handshake costs one round trip on top of the TCP connection. Session resumption removes most of that for returning visitors. Neither behaviour changes with the price of the certificate, because both are properties of the protocol and the server configuration.
Chain length does matter. Every intermediate certificate the server sends is more bytes in the first flight, and a misconfigured chain that forces the client to fetch a missing intermediate turns a fast handshake into a slow one. Serve the full chain in the right order and verify it rather than assuming.
OCSP stapling is the other one worth checking. Without it, some clients make their own revocation request to a third party before they trust your certificate, which adds a lookup you do not control. With it, your server presents the proof itself.
Measure it rather than argue about it
curl reports the timing breakdown of a request if you ask it to: name resolution, TCP connect, TLS negotiation and time to first byte, each as a separate figure. The TLS portion is the one this page is about, and seeing it isolated ends most arguments immediately.
For the chain, openssl connecting to your host prints every certificate the server presented, in order, along with the negotiated protocol and cipher. If an intermediate is missing you will see it here before a visitor's browser does.
Run the same measurement against a site using a paid certificate and one using a free automated one. The numbers will be indistinguishable, and having generated them yourself is worth more than being told.
When paid is a requirement rather than an upgrade
Wildcard coverage is the honest case. One certificate covering every subdomain spares you a pile of separate issuances and renewals, and if you run staging, development and per-client subdomains that is genuine operational value. A Wildcard SSL Certificate is available here for exactly that.
Organisation validation is the second. If a partner's security review opens your certificate looking for verified company details, only OV or EV puts them there. An EV SSL Certificate is available when a written policy or a high-value payment flow demands the deepest audit.
The third is procurement paperwork that names a commercial authority. That is a compliance requirement rather than a technical one, and treating it as such keeps the decision honest.
Automate it and stop thinking about it
Every plan here ships free SSL that issues as soon as the domain points at us and renews itself well before expiry. An expired certificate is a total outage for a site, and automation removes the most common cause of one — a calendar reminder nobody acted on.
Automation also removes the failure mode where the certificate renews but the service was never reloaded, so the old file is still being served. If you run anything by hand, monitor the expiry of what is actually being presented rather than what is on disk.
The security posture around it matters more than the certificate tier: Imunify360 on the higher plans, ImunifyAV+ scanning, DDoS filtering at the edge and account isolation. A padlock on a compromised site is not a security outcome.
A claim you can disprove in five minutes
We will not tell you a paid certificate is faster or more secure, because you can check that with curl and openssl before finishing this page. Claims that survive testing are the only ones worth making.
Free SSL comes on every plan and renews itself, with wildcard and EV certificates available for the cases that genuinely need them.
- Same TLS 1.3, same cipher suites
- Chain order and stapling, verified
- curl for timing, openssl for the chain
- Automated renewal, monitored anyway
Why HostingFast
Standard on every plan
Free SSL that renews itself
Issued the moment your domain points here and renewed ahead of expiry, on every plan without exception.
Wildcard when subdomains multiply
A Wildcard SSL Certificate is available for staging, development and per-client hostnames.
EV when policy demands it
An EV SSL Certificate is available where a written requirement or a high-value payment flow calls for the deepest audit.
HTTPS end to end
Encrypted from the browser to the origin, which is the part a PCI questionnaire actually asks about.
Filtering ahead of the certificate
DDoS filtering absorbed at the network edge, because a padlock on an unreachable site is not much use.
Malware scanning behind it
ImunifyAV+ sweeps every site, with Imunify360 in front on the higher tiers.
Quick Start
From order to online
- 1
Time the handshake with curl
Ask curl for its timing breakdown and isolate the TLS portion from DNS, TCP connect and time to first byte. That single figure is what a certificate could theoretically affect, and it is where the argument ends.
- 2
Verify the chain with openssl
Connect to your own host and read back every certificate presented, in order, plus the negotiated protocol and cipher. A missing intermediate is invisible in most browsers and expensive in the ones that notice.
- 3
Monitor what is served, not what is stored
Check the expiry date on the certificate actually being presented on the wire. Renewal that succeeded without a service reload is the classic silent failure, and it only surfaces when a visitor hits a warning.
Built In
Loaded onto every plan
- Free SSL on every plan, issued automatically and renewed before expiry
- Wildcard SSL Certificate available when subdomains multiply
- EV SSL Certificate available where policy or payment flow requires it
- HTTPS end to end, ready for the PCI questions that follow
- DDoS filtering absorbed out at the network edge
- ImunifyAV+ scanning every site, with Imunify360 on the higher tiers
- LiteSpeed caching in front of PHP on every plan
- NVMe SSD storage on every tier, not only the expensive ones
- Daily backups with self-service restores from the panel
- No setup fee, and a renewal at the rate you ordered at
Frequently Asked
What people ask us most often
Does a paid certificate make TLS faster?
No. The handshake, the cipher suite and the protocol version are identical whichever certificate you install. Handshake time is decided by round trips, chain length, session resumption and stapling — all server configuration. You can confirm the whole thing with a curl timing breakdown in about a minute.
How do I measure the TLS handshake cost on my own site?
Use curl's timing write-out and read the values for name lookup, connect, app connect and starttransfer. The gap between connect and app connect is your TLS negotiation. Compare a cold request with a repeat one and you will also see what session resumption is saving you.
Do I need a wildcard for staging and development subdomains?
You need certificates for them, and a wildcard is the tidy way to get them. Free automated certificates work fine per hostname, but once the list of subdomains grows the renewal admin adds up. That operational saving is the real argument for a wildcard, not encryption strength.
What happens if a certificate expires overnight?
Browsers show a full interstitial warning and effectively the site is down. That is why every plan here issues and renews SSL automatically. If you manage any certificate by hand, monitor the expiry of the certificate being served on the wire rather than the file on disk — renewal without a reload is the usual culprit.
Keep reading
Hosting With Redis Object Caching
Where an object cache earns its place on sites that page caching alone cannot rescue.
Static HTML Site Hosting
Serving hand-written HTML and generator output with as little between the file and the visitor as possible.
Let's Encrypt (Glossary)
How automated domain validation works, and what it does and does not assert.
SSL Certificates
Free SSL on every plan, with wildcard and EV certificates when a requirement names them.
CMS Hosting
Hardened, cached hosting for WordPress, Joomla, Drupal and the rest of the major platforms.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Automate the padlock.
Free SSL that issues and renews itself on every plan, with wildcard and EV available the day a requirement actually names one.
View SSL Certificates plans