What SSL certificate to buy this month, if you only buy one.
The cert market changed twice in the last 18 months: max TLS validity is on a fast track to 47 days under CA/B Forum SC-081v3, and code-signing keys must live on hardware tokens. Most "best SSL" lists on the open web have not noticed yet. This site is a working sysadmin's running answer to which one to actually buy this quarter, with the prices buyers actually pay. Updated when something material changes.
PositiveSSL DV
Domain-validated · 1 yr
Pros
- Issues under 5 min, no support contact
- SHA-256, 2048-bit RSA, ECC available
- Trusted by 99.9% of browsers
- Unlimited reissues, 30-day refund
Cons
- No multi-domain SAN slots
- Auto-renew jumps to $19.98 after year 1
- DV only — no org info shown to visitors
first year, single domain · auto-renews at $19.98
Buy at Namecheap →SSL Wildcard
Domain-validated · unlimited subdomains · 1 yr
Pros
- Covers *.example.com in one cert
- Issues in under 1 hour, automated DCV
- Reused Sectigo intermediate, fast OCSP
- Site-seal optional, free
Cons
- No multi-domain SAN slot
- DV only — no organization vetting
- Renewal at full $99 after first year
EV Code Signing
Extended validation · FIPS 140-2 · 1 yr
Pros
- Microsoft SmartScreen recognizes EV signers immediately
- YubiKey 5 FIPS shipped, no Sectigo overhead
- Apple Notary compatible
Cons
- Re-keying takes 1-3 business days
- Hardware token mandatory (no soft cert option)
- Lost token = full re-validation cycle
SecureSite Pro EV
Extended validation · single FQDN · 1 yr
Pros
- For procurement reviewers who require an EV doc
- Site seal and Norton mark included
- DigiCert brand recognition with reviewers
Cons
- Validation: 5-7 business days
- Roughly 3× the price of equivalent Sectigo OV
- No bulk or multi-year discount on this SKU
Premium SSL OV
Organization-validated · 1 yr
Pros
- Org details visible in cert detail panel
- Site seal license included
- Free site-seal verification page
Cons
- Issuance takes 1-3 business days (DV is <1h)
- Document submission required (D-U-N-S or equivalent)
- ~5× the price of an equivalent DV
PositiveSSL Multi-Domain (3 SAN)
DV · up to 100 domains · 1 yr
Pros
- 3 SAN slots included in base price
- One cert covers many domains, one renewal
- Best price under $20 we have ever tracked
- Sectigo CA chain, broad browser trust
Cons
- +$8 per SAN slot after the included 3
- DV only — no organization vetting
- Not wildcard-compatible (need separate cert)
Free tools
SSL certificate decoder
Paste a PEM, get the structured fields back. Subject, issuer, SANs, validity, fingerprints.
/csrCSR + private key generator
RSA 2048/4096, ECC P-256/P-384. Built client-side, key never leaves the browser.
/chainCertificate chain validator
Pastes the server response, tells you what's missing from the intermediate bundle.