SSL certificates from the brands browsers trust, issued faster

An SSL certificate is a small data file, issued by a trusted certificate authority, that proves your website is genuinely yours and encrypts the connection between your server and your visitors. It is what turns http into https and shows the padlock in the browser. Without one, browsers mark your site as “Not secure” and many visitors leave.

Yes, in everyday use. TLS (Transport Layer Security) is the modern protocol that replaced SSL, but the certificates are still widely called SSL certificates. Every certificate we sell works with current TLS versions.

They differ in how much the certificate authority verifies. Domain validation (DV) only confirms you control the domain. Organisation validation (OV) also confirms your company is a registered legal entity, and shows its name in the certificate. Extended validation (EV) adds the strictest identity checks and is the standard for banks and payment sites. The encryption is equally strong at all three levels.

A Subject Alternative Name (SAN) is a field inside an SSL certificate that lists every hostname the certificate protects. Browsers check this list to decide whether the certificate is valid for the site you are visiting.

A certificate with several SANs is called a multi-domain or SAN certificate. One certificate can then secure, for example, yourcompany.co.za, www.yourcompany.co.za, yourcompany.co.zw and mail.yourgroup.com. You can usually add more SANs to the certificate later and reissue it.

A wildcard certificate (*.yourcompany.co.za) covers one domain and an unlimited number of subdomains at one level, such as mail, portal and shop. It does not cover a second level like dev.portal.yourcompany.co.za, and it cannot cover a different domain.

A SAN (multi-domain) certificate covers a specific list of names, which can be completely different domains, such as yourcompany.co.za and yourbrand.com. Choose a wildcard when you have many subdomains on one domain, and a SAN certificate when you have several domains. If you need both, a multi-domain wildcard combines them. Note that EV certificates are not available as wildcards.

A certificate signing request (CSR) is a block of encoded text generated on your server. It contains your domain name, company details and public key, and the certificate authority uses it to create your certificate. Your private key stays on your server and is never sent to us or the CA.

You can create one with our free tool on the Generate CSR page, which also explains how to do it on Apache, Nginx, IIS and other platforms.

Paste your CSR into the CSR checker on our Generate CSR page. It decodes the request and shows the common name, organisation, country, key type and key size, so you can spot mistakes before you order.

Check three things in particular: the common name matches the exact domain you want to secure, the key is RSA 2048-bit or larger (or ECC), and your company name is spelt exactly as registered if you are ordering an OV or EV certificate. If anything is wrong, generate a new CSR rather than ordering with the old one.

The price depends on the brand, the validation level (DV, OV or EV), whether you need a wildcard or extra SANs, and how many years of coverage you buy. A domain-validated RapidSSL or PositiveSSL certificate sits at the low end, and a DigiCert EV or multi-domain certificate at the high end.

You can see live prices for every certificate in our SSL store, with our discounts already applied: 40% off retail on Thawte, GeoTrust and Sectigo, 35% on RapidSSL and 20% on DigiCert. For volume orders or a quote, email sales@primasecure.com.

Certificate authorities sell directly at their full retail price. As a high-volume partner and one of Africa’s largest DigiCert and Sectigo resellers, we buy at partner pricing and pass a large part of that saving on to you.

You get exactly the same certificate: it is issued by the same certificate authority, from the same root, with the same validation and warranty as if you bought it direct. The difference is that you pay less and also get our pre-validation, installation support and flexible billing.

Free SSL certificates encrypt traffic just as well, but they only offer domain validation. They cannot show your verified company name, which matters for banks, payment pages and login portals where visitors and auditors need to know who they are dealing with.

A paid certificate also comes with a warranty from the certificate authority, OV and EV options, multi-year plans, and people to call when something breaks. Free certificates have short lifetimes and depend on automated renewal working every time; if it fails, your site shows a security warning with no one to help. With Prima Secure you also get pre-validation and free installation support.

Domain-validated certificates are usually issued within minutes. OV certificates typically take 1 to 3 business days and EV 1 to 5 business days, depending on how quickly your company details can be verified. Because we pre-validate every request before it reaches the certificate authority, our customers’ OV and EV orders usually clear at the faster end of that range.

Industry rules set by the CA/Browser Forum are shortening certificate lifetimes. Since 15 March 2026, a publicly trusted SSL certificate can be valid for a maximum of 200 days. That drops to 100 days in March 2027 and 47 days in March 2029.

You can still buy multi-year plans: you pay once for one or more years of coverage and reissue the certificate during the term at no extra cost. We help you plan reissues so your site never runs on an expired certificate.

Yes. Most of our customers came to us at renewal time. Send us your domain and current expiry date, and we will order the replacement in time, pre-validate it and help you install it, so there is no gap in coverage. You do not need your old provider’s involvement.

You can pay online in our SSL store, or use our flexible billing: we issue your certificate and you have 7 days to settle the invoice. For businesses with many certificates, we can consolidate everything under one account.

Yes, at no extra cost. Our engineers help you install the certificate on your web server, load balancer, firewall or hosting control panel, and check that the full certificate chain is served correctly.