Certificate options at a glance
| Host | Free certificate | Wildcard | Upload your own | Renewal |
|---|---|---|---|---|
| Kinsta | Yes, through its Cloudflare integration, issued automatically after the domain is added | Included free on Managed WordPress plans, covering unlimited subdomains | Yes: private key plus certificate and CA bundle pasted in MyKinsta; a wildcard domain needs a wildcard custom certificate | Free certificate renews automatically while the _acme-challenge CNAME exists; notices 30 days before expiry. Custom certificates: you renew, and Kinsta sends no expiry notices |
| WP Engine | Let's Encrypt on the Legacy Network; automatic through Cloudflare on Advanced Network and Global Edge Security | Not provided; buy one elsewhere and import it | Yes, RSA .key with PEM .pem, .crt or .cer; not on Lite or Startup plans; on Shared plans, Production environments only | Let's Encrypt: 90-day certificates, auto-renewal attempted 22 days before expiry. Imported certificates do not auto-renew |
| SiteGround | Let's Encrypt from Site Tools > Security > SSL Manager | Let's Encrypt Wildcard and Premium Wildcard are both listed; Premium Wildcard is ordered in the Client Area Marketplace | Yes, Site Tools > Security > SSL Manager > Import with CRT, private key and CA bundle | Let's Encrypt (90-day validity) renewed automatically for free 30 days before expiry |
| DigitalOcean WordPress 1-Click Droplet | Caddy obtains Let's Encrypt certificates automatically | Not covered by the 1-Click documentation | Yes, by editing the web server configuration; DigitalOcean notes commercial certificates usually remain valid for one year or longer | Caddy renews automatically; on a Certbot setup, check with sudo certbot renew --dry-run |
Why subdomain course portals raise the wildcard question
Course businesses often split a site into academy.example.com, members.example.com and shop.example.com. A wildcard certificate covers every first-level subdomain of one domain, as SiteGround's knowledge base describes it, so new portals are covered without a new certificate each time.
Let's Encrypt only issues wildcards through the DNS-01 challenge, which proves control by placing a TXT record at _acme-challenge for the domain; its documentation says the HTTP-01 challenge cannot issue wildcards and only works on port 80. That is why wildcard support depends on how the host reaches your DNS. Kinsta's renewals rely on an _acme-challenge CNAME record that you keep in place; if it is removed, you re-add it and click Renew SSL.
WP Engine says it provides only free single-domain certificates and lists a wildcard as a reason to import a third-party certificate. That is workable for three named portals, each added as its own domain; for dozens of dynamically created subdomains you would need an imported wildcard, which Lite and Startup plans cannot use and which you renew by hand.
Uploaded certificates: who renews and what breaks
Every host here accepts a certificate you bought elsewhere, and the two that document renewal of uploaded certificates both leave it to you. Kinsta says custom certificates must be renewed with the provider that sold them, that it does not send expiry notifications for them, and that if you remove one, the site falls back to the free Cloudflare certificate while you add the replacement. WP Engine says third-party certificates cannot auto-renew because it is not the issuer; the renewed certificate is added as a new third-party SSL.
Format errors are the usual failure. Kinsta wants the private key (.key) and the certificate (.cert, .cer or .crt), with the CA bundle pasted after the certificate in the same field, and suggests choosing Nginx as the server type when buying. WP Engine wants an RSA key and a PEM certificate. SiteGround wants the CRT, the private key generated with the CSR, and the CA bundle, and the certificate must cover the bare domain.
A premium certificate rarely adds anything a course site needs over a free one; the main reasons to upload are a wildcard on a host that does not issue one, or an organisation-validated certificate required by a client contract.
Renewal failures and how to prevent them
- CAA records: WP Engine says to remove conflicting CAA records, and Kinsta shows a Fix domain error button when a CAA record blocks issuance
- DNS must point to the host before requesting the certificate; WP Engine says to point DNS first to prevent errors, and activation usually takes minutes but can take up to 24 hours
- Kinsta: keep the _acme-challenge CNAME in DNS or renewals stop
- WP Engine: ordering a Let's Encrypt certificate replaces any existing certificate for that domain
- Imported certificates on any host: add a calendar reminder at least 30 days before expiry
- Droplets on Certbot: run sudo certbot renew
--dry-runafter any server change; DigitalOcean says no errors means renewal works
Which setup fits which course site
One domain with www: any of the four works with the free certificate, and nothing needs uploading. A handful of named subdomains: WP Engine's per-domain certificates and SiteGround's or Kinsta's wildcard options all work. Many or user-created subdomains, such as a multisite network for cohorts: Kinsta's included wildcard or SiteGround's wildcard options avoid buying and renewing a certificate by hand, while WP Engine needs an imported wildcard on an eligible plan.
On a Droplet, you own the whole chain. The 1-Click image's Caddy server handles renewal, but a wildcard or custom setup is configuration work you or your developer maintain.
Questions before you decide
Does WP Engine offer free wildcard SSL?
No. WP Engine's SSL documentation says it only provides free single-domain certificates. A wildcard has to be purchased externally and imported as a third-party certificate, which Lite and Startup plans cannot do, and imported certificates do not auto-renew.
Is a wildcard certificate free at Kinsta?
Kinsta's SSL documentation says its free certificates include wildcard support covering unlimited subdomains on Managed WordPress Hosting plans, renewed automatically while the _acme-challenge CNAME record stays in DNS.
Who renews a certificate I upload myself?
You do. Kinsta says custom certificates are renewed with the provider you bought them from and it sends no expiry notices for them; WP Engine says third-party certificates cannot auto-renew because it is not the issuer. Plan the replacement before the expiry date.
How often does SiteGround renew Let's Encrypt certificates?
SiteGround's knowledge base says Let's Encrypt certificates are valid for 90 days and its system renews them automatically for free 30 days before expiration.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Kinsta docs: SSL certificates Accessed 30 Oct 2026
- WP Engine support: SSL certificates Accessed 30 Oct 2026
- SiteGround KB: Types of SSL certificates Accessed 30 Oct 2026
- SiteGround KB: What is wildcard SSL Accessed 30 Oct 2026
- SiteGround KB: Install a third-party SSL Accessed 30 Oct 2026
- SiteGround KB: Let's Encrypt renewal Accessed 30 Oct 2026
- Let's Encrypt docs: Challenge types Accessed 30 Oct 2026
- DigitalOcean docs: WordPress 1-Click Accessed 30 Oct 2026
- DigitalOcean support: Install an SSL certificate on a Droplet Accessed 30 Oct 2026
- DigitalOcean support: Renew Let's Encrypt certificates Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.