Google Trust Services (Free public CA) review 2027

What problem does Google Trust Services solve?

Google Trust Services is Google's own certificate authority, and it issues certificates free over ACME. That matters because a trusted TLS certificate is what turns a browser warning into a padlock, and the paid certificate industry has spent years charging for something a free authority can do. This one comes from one of the most widely trusted roots, and it covers wildcards at no cost.

The tagline frames the audience precisely: it is the natural choice if your infrastructure already lives in Google Cloud. On Google Cloud Load Balancing and App Engine, issuance is automatic. The verdict is blunt about the trade: on Google Cloud this is the path of least resistance and costs nothing, but anywhere else Let's Encrypt does the same thing without a cloud account. It finished fifth of six tested certificates with a score of 7.7.

How did it score in our testing?

We scored it across five criteria. Issuance and validation earned 21 of 25 points, measuring the time from payment to an installed, trusted certificate on our test domain and how painful domain or organisation validation was. Coverage took 15 of 20, covering subdomains, wildcards, multi-domain SAN slots and the trust stores the issuing root reaches.

Warranty and assurance was the weakest area at 6 of 15, reflecting the stated warranty, the validation level offered and the site seal. Support and tooling scored 11 of 15, based on installation help, CSR tools, auto-renewal, API and how quickly support answered a real installation question. Value was the strongest result at 24 of 25, judged on annual cost against what a free Let's Encrypt certificate already gives you.

What does it do well?

The certificate is free, including wildcards, and it chains to one of the most widely trusted roots. Because it speaks standard ACME, Certbot and similar clients work unchanged, so existing automation does not need rewriting. On Google Cloud Load Balancing and App Engine, issuance and renewal happen automatically.

Rate limits are generous for larger estates, which matters when you manage many hostnames. In our test, a certificate was issued in 2 minutes. Reissues are unlimited and free, so a misconfigured hostname or a lost key is not a billing event.

How does ACME and DV validation actually work?

ACME is an automated protocol for proving you control a domain and then receiving a signed certificate. Your client creates a key pair, asks the authority for a challenge, and publishes a token the authority can check — either as a file on your web server or as a DNS record. Once the check passes, the certificate is issued and can be renewed on a schedule without human involvement.

DV, or domain validation, means the authority verifies only control of the domain name. It does not verify a company's legal identity, which is what OV and EV add. That is why DV certificates issue in minutes and carry no warranty.

What do you actually get?

The specification sheet is short. The cheapest certificate is 0 USD/yr, and the wildcard price is also 0 USD/yr. Validation is DV only. There is no warranty. In our test it issued in 2 minutes. Free reissues are unlimited, and there is no refund window because nothing is purchased.

There is no site seal and no support desk attached to the certificate. What you get instead is an API-driven authority that fits into infrastructure you already run, provided that infrastructure is on Google Cloud.

How does it compare with other certificates we tested?

Let's Encrypt scored 8.3 and is also free, with DV validation, wildcards at 0 USD/yr, no warranty, and issuance in under 1 minute in our test. It is the direct alternative, and the verdict says so: outside Google Cloud it does the same job without a cloud account. Google Trust Services edges ahead on rate limits for larger estates and on native Google Cloud automation.

SSLs.com scored 8.5 at 3.88 USD/yr, offering DV, OV and EV, wildcards at 71.88 USD/yr, a $50,000 warranty on PositiveSSL, issuance in 6 minutes, free unlimited reissues and a 15-day refund window. It is the cheapest paid route here and adds a warranty and a support desk that Google Trust Services does not have.

ZeroSSL scored 8.1, free with paid plans from $10/mo, DV only, wildcards on paid plans at 600 USD/yr, no warranty on the free tier, issuance in 3 minutes and a 30-day refund window on paid plans. It offers a dashboard and one-year options that the Google authority does not.

Where does it fall short?

Setup friction off Google Cloud is where it lost. Using it requires a Google Cloud project and API setup, which is more work than Let's Encrypt. It is DV only, with no warranty and no support desk, so there is nobody to call when an installation goes wrong.

The final criticism is the sharpest: there is little reason to choose it outside the Google ecosystem. If your servers are not on Google Cloud, you are taking on account overhead for a certificate you could get elsewhere in under a minute.

Is it good value?

The price summary is Free, and value scored 24 of 25. That near-perfect result reflects the fact that a free Let's Encrypt certificate already covers the same ground, so the only thing left to judge is whether the Google integration earns its place. On Google Cloud it does; elsewhere the value case rests entirely on the rate limits.

Who should use Google Trust Services?

It is still right for Google Cloud infrastructure. If your workloads run on Google Cloud Load Balancing or App Engine, certificates are issued and renewed automatically at no cost, and there is no reason to pay a reseller. Teams managing large estates of hostnames also benefit from the generous rate limits.

If you are not on Google Cloud, the honest answer is that Let's Encrypt gives you the same DV certificate, wildcards included, without a cloud account. Choose this one when the Google ecosystem is already where your infrastructure lives.