SSL certificates

More than a padlock. Real certificates, real warranty.

Domain, organisation, and extended-validation SSL — from £39/yr to enterprise-grade. We handle the validation, the install, and the renewal. Your visitors just see the lock.

See certificates Talk SSL with us

We installNo DIY required

Auto-renewalNever expires on you

Warranty-backed£10k to $1.75M

All browsers99.9% root trust

Pick your trust level

Four levels of trust. One install team.

From basic encryption to full organisation validation. Every certificate is installed by us, renewed automatically, and monitored for issues.

DVDomain Validation

£39/yr

ValidationMinutes

Warranty£10,000

Most websites needing HTTPS — blogs, brochure sites, internal tools, anything where encryption is the goal and brand verification isn't.

Single domain coverage
Issued in minutes via email validation
256-bit encryption (AES-256, TLS 1.3)
Trusted by all browsers (99.9% root store)
Free unlimited reissues during term
Auto-renewal included

Order DV

OVOrganisation Validation

£89/yr

Validation1–3 days

Warranty£50,000

Established businesses where customers will inspect the certificate. Your registered company name appears in the cert details, not just the domain.

Single domain coverage
Company name verified by the CA
Visible in certificate details panel
Validation typically 1–3 working days
Site seal available for footer
Auto-renewal with re-validation reminders

Order OV

Recommended · Regulated industries

EVExtended Validation

£199/yr

Validation5–10 days

Warranty£1.5M

Banks, payment processors, healthcare, regulated industries — anywhere the strongest possible identity attestation matters. Strictest verification process available.

Single domain coverage
Most rigorous CA/B Forum verification
Full legal entity audit (phone, registry, address)
£1.5M aggregate warranty
Premium site seal with logo
Priority renewal handling

Order EV

WildcardDV Wildcard

£99/yr

ValidationMinutes

Warranty£10,000

Sites with multiple subdomains — shop, blog, app, admin, staging, all under one certificate. One renewal, every subdomain covered.

Unlimited subdomains (*.yourdomain.com)
Covers existing & future subdomains
256-bit encryption (AES-256, TLS 1.3)
Issued in minutes via DNS validation
OV wildcard available (£249/yr)
Auto-renewal with DNS automation

Order Wildcard

All certificates issued by Sectigo and other root-trusted CAs. Need a multi-domain (SAN/UCC) certificate, code-signing cert, or volume discount across many domains? Talk to us

Provisioning flow

From order to padlock. Six logged steps.

Every Apaxon-installed certificate passes through six provisioning steps. Here's what happens after you click order — DV timing shown; OV adds 1–3 days at validation, EV adds 5–10.

ssl.apaxonhost.com / provisioning logLIVE

[00:00]
STEP 01ORDER PLACEDOK
DV certificate · yourdomain.co.uk
[00:18]
STEP 02CSR GENERATEDOK
2048-bit RSA key pair created on our server
[02:42]
STEP 03DOMAIN VALIDATIONOK
HTTP-01 challenge verified by Sectigo
[03:11]
STEP 04CERTIFICATE ISSUEDOK
Sectigo Limited · valid 1 year, chain attached
[03:30]
STEP 05INSTALLED & MONITOREDOK
Deployed to apaxon-prod-uk-01 · HTTPS live
[+335d]
STEP 06AUTO-RENEWAL SCHEDULEDSCHEDULED
Re-validates 30 days before expiry · cycle restarts

YOU1 thing

Click order. Reply to a verification email if the CA asks (mostly automated for DV).

APAXONEverything else

CSR generation, DCV setup, CA coordination, server install, expiry monitoring, auto-renewal — all of it.

Times shown for DV (Domain Validation) — typically 3–5 minutes end-to-end. OV adds 1–3 working days at step 03 for organisation verification. EV adds 5–10 working days for the full legal-entity audit.

Common questions

Before you order.

The questions we hear most often from teams shopping for SSL — including the elephant in the room about free certificates.

Honest answer: Let's Encrypt is great. We even include it free with every hosting plan. For blogs, hobby projects, and internal tools, it's all you need.
Paid certificates differ in four ways that matter for business-critical sites:
Warranty backing— if the CA misissues and your visitors suffer financial loss, the warranty pays (£10k–£1.5M depending on tier). Let's Encrypt has none.
Organisation validation— OV and EV name your legal company in the cert details panel. Let's Encrypt is domain-only.
One-year terms— paid certs run 12 months; Let's Encrypt is 90 days. Fewer renewal events, fewer chances for something to go wrong.
Someone runs it for you— provisioning, install, monitoring, renewal. With Let's Encrypt you can certainly do it yourself, but if it breaks at 3am Sunday, that's on you.
All three deliver the same encryption (AES-256, TLS 1.3) and show the same padlock in modern browsers. The difference is what the Certificate Authority verified before issuing the cert — and what appears in the certificate details panel when someone clicks that padlock.
DV (Domain Validation).The CA checks that you control the domain. That's it. Issued in minutes via email or DNS challenge. Suitable for most sites that just need HTTPS.
OV (Organisation Validation). DV plus the CA verifies your company exists — registry checks, callback to your registered phone number. Your legal company name appears in the cert details. 1–3 working days to issue.
EV (Extended Validation). OV plus a full legal entity audit — registered address, physical premises check, exclusive right to the domain. Strictest verification available. 5–10 working days to issue.
Who actually reads cert details? Mostly: regulatory auditors, security researchers, and automated trust systems. For most marketing websites, DV is enough. For e-commerce and trust-sensitive sites, OV. For regulated industries, EV.
This one is widely misunderstood. The SSL warranty insures your visitors, not you. If the Certificate Authority misissues a certificate (issues one to someone who shouldn't have it) and a visitor to your site suffers financial loss as a result of trusting that misissued cert, the warranty compensates them up to the stated amount.
In practice, CAs almost never pay out. Modern certificate issuance is rigorously controlled — misissuance events are rare, and they usually involve specific technical vulnerabilities rather than individual cert errors.
So what's the warranty actually for? It's an institutional commitment. A £1.5M warranty is the CA saying "we stand behind our verification process to this dollar value". It's a credibility signal more than a likely payout.
Treat the warranty as a useful trust marker for stakeholders who ask, not as insurance you'll personally claim against. The honest version: pay for SSL for the validation, the install service, and the support — the warranty is a bonus.
Any host. The certificate is yours — once issued, you can deploy it anywhere that accepts a standard SSL cert (which is basically everywhere: Plesk, cPanel, AWS, Vercel, Cloudflare, Azure, custom Linux servers).
If we have direct access to your server, we install for you. If not — common for clients hosted with another provider — we send you the certificate files plus step-by-step installation guidance for your specific platform. We can also coordinate directly with your host's support team if you want us to.
ApaxonHost is the easiest option simply because we already have the access. But it's never required, and we don't charge extra to issue a certificate that lives elsewhere.
Nothing, in most cases.
DV renewals.We re-issue and re-install automatically, 30 days before expiry. The DCV challenge runs in the background, the new cert deploys, you get a confirmation email. You probably won't notice it happened.
OV renewals. We coordinate the re-validation with the CA. Usually fast, but the CA may need to confirm your company is still active via registry check or callback. We handle the coordination; you might get one phone call.
EV renewals. Full re-audit. The CA verifies your legal entity is still in good standing, registered address still valid, exclusive domain rights still held. We start this 60 days before expiry to leave time for the validation.
If anything needs your input — verification email, callback to confirm something — we prompt you well before the deadline. The certificate doesn't lapse on our watch.
True — Chrome and Firefox removed the green "Verified by [Company Name]" address bar in 2019. EV no longer has the visual prominence it once had, and most marketing claims that lean on that imagery are out of date.
EV is still worth it for three specific reasons:
Compliance requirements. PCI DSS, HIPAA, certain financial-services regulations, and government procurement frameworks still specify EV certificates. If your industry mandates EV, the cost is non-negotiable.
Phishing resistance.Obtaining an EV cert requires weeks of legal-entity verification by the CA. Attackers can't spoof it cheaply. For brands frequently targeted by phishing campaigns, EV materially raises the attacker's cost.
Stakeholder signalling.Auditors, security teams, and sophisticated users do still check cert details. "Issued to: [Legal Entity Name]" reads as verification in ways DV-only certs don't.
For most businesses, OV is the better middle ground — verified organisation, faster issuance, much lower cost. Ask if you're not sure whether your situation justifies EV.

01/06

Why pay for SSL when Let's Encrypt is free?

Honest answer: Let's Encrypt is great. We even include it free with every hosting plan. For blogs, hobby projects, and internal tools, it's all you need.

Paid certificates differ in four ways that matter for business-critical sites:

Warranty backing— if the CA misissues and your visitors suffer financial loss, the warranty pays (£10k–£1.5M depending on tier). Let's Encrypt has none.

Organisation validation— OV and EV name your legal company in the cert details panel. Let's Encrypt is domain-only.

One-year terms— paid certs run 12 months; Let's Encrypt is 90 days. Fewer renewal events, fewer chances for something to go wrong.

Someone runs it for you— provisioning, install, monitoring, renewal. With Let's Encrypt you can certainly do it yourself, but if it breaks at 3am Sunday, that's on you.

Issuance ready

Issuance queue open. Pick a tier.

apaxon-ssl-uk is online, Sectigo connection live, CA verification path ready. Pick a tier and we provision in minutes for DV — days for OV/EV.

ssl.apaxonhost.comISSUING

STATUS: Connected to Sectigo
TURNAROUND: DV in 3–5 minutes
WARRANTY: £10k to £1.5M

Order CertificatePick a tier aboveinfo@apaxonhost.com

Sectigo-issued · UK-installed · Auto-renewed · Warranty-backed