ZeroSSL

What ZeroSSL actually is

ZeroSSL is a certificate authority, not a host. It issues TLS certificates — free 90-day ones, paid "annual" ones, wildcards and multi-domain SANs — and wraps them in a management product: a web console, one-step domain validation, SSL monitoring, installation checks, ACME support and a REST API. It launched in early 2016 in Vienna as a convenience layer over third-party certificate vendors, then became a trusted CA in its own right as the user base grew. Since January 2024 it has been owned by HID Global, and the founders (Julian and Paul Zehetmayr) built it into a product now claiming millions of certificates issued monthly.

In our view the honest framing is this: Let's Encrypt made TLS free and automated from the command line, and ZeroSSL exists because a lot of people want the same thing with a browser UI, email validation, a support desk and a company to invoice. That is a real market — small agencies, hosting resellers, teams without a certbot pipeline, and anyone who needs OV/EV or wants a second CA in their renewal logic so a single CA incident does not take down their fleet.

The category comparison matters here. Everything on our SSL certificates page serves the same protocol; the differences are validation methods, warranty levels, tooling, price and what happens when something breaks. ZeroSSL's particular combination is: free tier that works in a browser, serious automation for people who want it, and an enterprise path through the parent company.

Pricing: what you really pay

The free plan is real: no credit card required, 3 × 90-day certificates, with multi-domain, wildcard and ACME certificates listed as supported features. ZeroSSL's own about page claims "up to five" free 90-day certificates plus unlimited certificates via major ACME integrations, which does not match the pricing page's "3 90-Day Certificates" — we flag the inconsistency rather than pick a winner, and we would design around the lower number. Either way, the free tier is aimed at exploration and small sites: it is certificate-count-limited, not feature-limited.

Paid plans, billed yearly on the current pricing page: Basic at $14.99 per month, Premium at $68.99 per month, Business at $129.99 per month, each with a "+ Protect" variant that adds scanning (surface scans, core scans, risk analysis, malware and vulnerability detection). What scales across the tiers is mainly the annual-certificate allowance — Basic includes 5 annual certificates and unlimited 90-day ones; higher tiers add more annual certificates and more annual wildcards — plus API access levels and support priority. Note that older price listings floating around the web ($8/$40/$80 per month, three annual certs on Basic) are from 2022 and no longer match the vendor's site.

Above the public plans sit pre-defined Platinum packages, billed annually: $2,039.90 per year for 40 annual certificates and 6 annual wildcards, $3,359.90 for 75/10, $4,679.90 for 100/15, and $6,719.90 for 150/25 — all with unlimited 90-day certificates and wildcards. Custom contracts are available beyond that. For anything involving OV/EV and full certificate lifecycle management, the path runs through HID Global's Enterprise SSL (centralised management across DV/OV/EV, SLA-backed priority support, flat-rate subscription), which is a sales conversation rather than a checkout.

One industry-specific detail worth understanding before you budget: under CA/Browser Forum Ballot SC-081v3, certificate lifetimes are compressing. ZeroSSL's "annual certificates" (formerly 1-year certificates) must be renewed no later than day 199, with the first renewal costing no extra credit and extending validity for the remainder of the year. Shorter lifetimes mean more renewals, which is exactly why automated ACME or REST API renewal is the default recommendation, not an advanced feature.

Performance & infrastructure

Certificate issuance is fast in practice: validation via email, HTTP file upload or CNAME record, with "one-step validation" and issuance described in minutes. Wildcards work across certificate types; multi-domain SANs require per-domain validation, which is standard for the industry. Trust coverage is the universal 99.9% of browsers — same root-store reach as Let's Encrypt and the commercial CAs. The tooling is the differentiator: a management console at no extra cost, REST API covering issuance, CSR validation and lifecycle tasks, ACME compatibility with the major clients (certbot, acme.sh and the usual hosting-panel integrations), SSL monitoring and installation checks that catch misconfigured chains — the most common real-world TLS failure.

Scale claims on ZeroSSL's own pages are inconsistent, which we treat as a marketing problem rather than a performance one: the homepage says 5+ million certificates generated monthly and 2+ million clients, the about page says 1+ million certificates monthly and 500,000+ clients. Both cannot be current. The underlying CA operation is now backed by HID Global's infrastructure and compliance organisation, which in our view is the more meaningful reliability signal for anyone deciding whether to trust the chain — a CA acquired by a large identity and security vendor in 2024 is not going away, and its audit posture sits under a bigger compliance umbrella.

On reliability of the service itself: there is no published uptime SLA for standard plans. Enterprise SSL through HID is described as "SLA-backed". For most users the availability that matters is the renewal path — and since certificates can be fetched days in advance and held, an outage on issuance day is an inconvenience rather than an outage, provided your automation retries. That is the operational posture we recommend for any CA, including Let's Encrypt.

Where it falls short

Value, bluntly. Let's Encrypt is free for unlimited certificates with the same browser trust, and if your workflow is already automated there is no certificate-count reason to pay $14.99 per month. What you buy from ZeroSSL is the UI, validation flexibility, monitoring, API convenience and support — legitimate, but priced like a SaaS product rather than a commodity. For a single small site on a budget, certbot plus Let's Encrypt remains our default recommendation, and ZeroSSL earns its fee when you are managing dozens of domains, need a second CA, want email-based validation for non-technical clients, or need an OV/EV route.

The free tier's hard cap of three certificates (or five, depending on which ZeroSSL page you read) makes it awkward for multi-site users, and the marketing inconsistencies noted above — certificate counts, monthly issuance numbers, client counts — are exactly the kind of thing that makes a comparison site's job harder. The plan matrix with "Basic" and "Basic + Protect" variants and credit-based annual certificate quotas takes real reading to compare against competitors.

Also, being bought by HID Global cuts both ways: enterprise credibility and compliance up, small-customer priority uncertain. ZeroSSL's Trustpilot score of 4.6 across roughly 183 reviews is decent, but the sample is small, and support responsiveness on low tiers is the recurring theme in third-party reviews of CA products generally. We would test the support path with a pre-sales question before committing an agency's certificate operations to it.

Who should pick this

Our pick for freelancers and small agencies who manage certificates for clients and want a browser console, email validation and a single invoice — especially where the client's hosting panel already integrates ZeroSSL. It is also a sensible second CA for larger fleets (CA diversification is real operational hygiene after the last few years of CA incidents), and the REST API plus ACME support means the automation crowd loses nothing versus the free alternatives.

We would not pick it for a single hobby site (use Let's Encrypt), for teams whose hosting already issues and renews certificates automatically (you will never log in), or for enterprise PKI needs without talking to HID about the Enterprise SSL product specifically — that is a different sale with different terms.

If you are choosing between ZeroSSL and commercial CAs like Sectigo or DigiCert for OV/EV, the comparison is really about warranty amounts, validation support and brand recognition in your market; ZeroSSL's DV product is not trying to be that, and its parent company is the answer for those cases.

Key takeaways

• Vienna-based CA founded 2016, acquired by HID Global in January 2024 — a mature DV-focused product with an enterprise parent.
• Free plan: 3 × 90-day certificates (the vendor's about page says five plus unlimited via ACME — inconsistent, plan for three), no credit card required.
• Paid tiers run $14.99 / $68.99 / $129.99 per month billed yearly; Platinum packages from $2,039.90 to $6,719.90 per year; OV/EV and lifecycle management come via HID Enterprise SSL.
• Tooling is the selling point: management console, REST API, ACME, monitoring and installation checks — with 99.9% browser trust like every mainstream CA.
• Under Ballot SC-081v3, "annual" certificates renew by day 199; automate renewal regardless of which CA you use.
• Value case is convenience and support, not price: automated Let's Encrypt remains unbeatable for pure certificate volume.

Sources

• https://zerossl.com/pricing
• https://zerossl.com/about
• https://zerossl.com/
• https://zerossl.com/features/certificates
• https://zerossl.com/protect
• https://zerossl.com/quote
• https://www.crunchbase.com/organization/zerossl
• https://www.cbinsights.com/company/zerossl
• https://platform.tracxn.com/a/d/company/577dec7ee4b07b51904cd67c/zerossl
• https://www.saasworthy.com/product/zerossl/pricing