Like others suggest you can go for Let’s Encrypt. Wildcard SSL/TLS Certificate is the choice to go with, it will offer protection for one main domain with sub-domain.
Which one to purchase is up to you, if you are serious about the website, like its related to work or any other important thing, you can opt for the paid wildcard SSL/TLS Certificate. Now, from which CA (Certificate Authority) to purchase, its all up to you. Different brands are available like Comodo, RapidSSL, GeoTrust, Thawte. You can go with whichever you want as per your budget as all are world renowned & branded. If you’re not sure, tools like our SSL Wizard are also available, where you just answer few of the questions and you will be provided with the list of SSL/TLS Certificates as per your requirements.
If you go for free like Let’s Encrypt, there’s nothing wrong in it. From a technical point of view, there's no risk involved using any of the SSL/TLS Certificates provided free of cost. As every SSL/TLS Certificate protocol confirms that the handshake made between any client or server should generate secure and robust session keys to stop spoofing of data and cyber-attacks like man in the middle. What everyone should look out for is that whether the free SSL/TLS Certificate is capable of providing real-time certificate status using any of OCSP (Online Certificate Status Protocol) or CRL (Certificate Revocation List) or not. The main thing is that the website owner should be capable of conveying a message to their website visitors that their website integrated with SSL/TLS Certificate is trustworthy.
Though some limitations do come in free SSL/TLS Certificates like, you have to manage your keys based on the installed client certificate in your browser. This can become a problem if you have to change your computer or you have to upgrade your OS and don't have any backup of installed client certificates. Some other limitations are like free certificates are offered for a limited period of time like 30, 60 or 90 days.
Apart from this, there does comes a possible disadvantage with Let's Encrypt due to which big companies definitely do not consider going with this. Let's Encrypt disadvantage is that visitors of the website cannot be sure that is the actual company is the one who is hosting the site. The main reason behind is that Let's Encrypt issues certificates for any webpage, without considering the need for identity validation (Personal or Corporate).
I hope it helps.