ZeroSSL: Free SSL Certificates, Automated
ZeroSSL is a certificate authority that issues free 90-day domain-validated certificates through the ACME protocol — with no rate limits, and including wildcard and multi-domain (SAN) certificates. It also offers a web dashboard for manual issuance and paid tiers that add 1-year certificates, REST API access, priority support, and website monitoring.
ZeroSSL is now part of HID Global. If you want free automated certificates with a dashboard and no ACME rate limits — or wildcards without running into Let's Encrypt's weekly limits — ZeroSSL is a strong choice. If you only need pure command-line automation, Let's Encrypt works equally well.
Get started with ZeroSSL
What the free plan includes
- Free 90-day certificates, issued via ACME, with no rate limits.
- Wildcard (*.example.com) and multi-domain / SAN certificates, included free via ACME — wildcards use DNS validation.
- A web dashboard for manual issuance if you'd rather not automate.
- Paid plans (from $52.99/month billed annually) add 1-year certificates, REST API access, priority support, and an optional "Protect" monitoring add-on. Most site owners never need to leave the free tier.
ZeroSSL vs Let's Encrypt
| Feature | ZeroSSL (free) | Let's Encrypt |
|---|---|---|
| Cost | Free | Free |
| Certificate validity | 90 days | 90 days |
| ACME support | Yes (default CA in acme.sh v3+) | Yes |
| Rate limits | None on free ACME | Yes (per-domain weekly caps) |
| Wildcard certificates | Yes, free (DNS-01) | Yes, free (DNS-01) |
| Web dashboard | Yes | No (ACME only) |
| REST API | Paid plans | No |
| Support | Paid tiers | Community only |
| Operated by | HID Global (commercial CA) | Nonprofit (ISRG) |
Bottom line: choose Let's Encrypt for pure automation on very mature tooling; choose ZeroSSL if you want a dashboard, no rate-limit headaches, or a paid path to 1-year certs, REST API, and support.
How to get a certificate
1Option 1 — Web dashboard (fastest for a single cert)
Sign up at zerossl.com , enter your domain, complete validation (email, DNS, or HTTP file), and download the certificate. Good for a one-off — no tooling required.
2Option 2 — ACME automation (recommended)
ZeroSSL is the default CA in acme.sh (v3+). Registering with your email automatically generates the EAB credentials ZeroSSL requires.
acme.sh --register-account -m you@example.com --server zerossl acme.sh --issue -d example.com -d www.example.com --dns dns_cf
Using certbot or another client? Get your EAB Key ID and HMAC key from the ZeroSSL dashboard (Developer section), then:
certbot certonly --server https://acme.zerossl.com/v2/DV90 \ --eab-kid YOUR_KID --eab-hmac-key YOUR_HMAC_KEY \ -d example.com
Affiliate disclosure: FixMyCert is a ZeroSSL affiliate and may earn a commission if you upgrade to a paid plan through our link — at no extra cost to you. ZeroSSL's free tier is genuinely free; we recommend it on its merits, and you never need a paid plan to get free 90-day certificates.