How to Get a Free SSL with 90 Day Free SSL? 3 Steps

Getting an SSL certificate that is free, valid for 90 days, and accepted by all browsers now takes just minutes. In this guide, we explain the three steps of our free SSL wizard from start to finish, using both the DNS (TXT) and HTTP (file) verification methods.

What do you need?

  • A domain you own (e.g., yourdomain.com).
  • An email address (for renewal reminders).
  • Access either to your DNS panel or to your web server's file system for verification.

A credit card or membership is not required; you can generate a certificate without signing up. If you do sign up, you can track all your certificates from a single panel.

Step 1 — Enter the details

On the wizard's first screen, enter your domain without a leading www. or https://. If you want, you can check the "include the www subdomain too" box to cover both yourdomain.com and www.yourdomain.com with a single certificate. Then type your email and click the "Continue to Verification" button.

Image: <Wizard step 1 — domain and email form>
In the first step, the domain, email, and www preference are entered.

Step 2 — Choose the verification method

To prove that the domain belongs to you, you choose one of two free methods.

Option A — Verification with DNS (TXT) (recommended)

This method doesn't require access to the server and supports wildcard certificates. The wizard gives you a TXT record:

Type:    TXT
Name/Host: _acme-challenge.yourdomain.com
Value:   p4N5x... (the unique string generated by the wizard)
TTL:     300 (or the lowest)

Create this record in your domain's DNS panel. Wait a few minutes for the DNS change to propagate, then click the "Complete Verification" button in the wizard. You can also check from the terminal to verify propagation:

dig +short TXT _acme-challenge.yourdomain.com
# or
nslookup -type=TXT _acme-challenge.yourdomain.com

Option B — Verification with HTTP (file)

This is ideal if you don't have access to DNS. The wizard gives you a file name and contents. You place this file on your server at this path:

http://yourdomain.com/.well-known/acme-challenge/<file-name>

After uploading the file, go to this address in your browser and confirm that the contents appear as plain text, then click "Complete Verification". Make sure this address is not redirected to HTTPS with a 301; the verification traffic comes over HTTP (80).

Image: <Wizard step 2 — DNS and HTTP method cards>
Two verification methods: DNS TXT (recommended) and HTTP file.

Step 3 — Download the ZIP package

When verification succeeds, your certificate is generated instantly and the "Your certificate is ready 🎉" screen appears. The ZIP package you download contains all the formats together:

  • certificate.crt — server certificate
  • private.key — private key
  • ca_bundle.crt — intermediate chain (for cPanel/Apache)
  • fullchain.pem — certificate + chain combined (for Nginx)
  • certificate.pfx — encrypted package for Windows/IIS

Whichever server you use, follow the relevant installation guide: cPanel, Nginx, Apache, or IIS. Each platform expects a different file, but they are all inside this single ZIP.

Next step: renewal

Let's Encrypt certificates are valid for 90 days. If you left the reminder option enabled, you'll receive emails 30, 7, and 1 day before the expiry date. To renew, you simply repeat the same three steps; the process is free again.

Summary

Getting a free SSL consists of three steps: enter the details, verify with a DNS TXT or HTTP file, and download the ZIP. To try it right away, open our free SSL wizard.