An SSL certificate lets a site use HTTPS, which encrypts the connection between a visitor and your server. This guide covers what it does, what it leaves alone and what to check.
An SSL certificate is a digital file that lets your website use HTTPS, so data between a visitor's browser and your server is encrypted and the site's identity is checked. Plain HTTP has no such protection. Modern certificates use TLS, the successor to SSL, but the old name stuck. If a certificate expires, browsers show visitors a warning.
What is an SSL certificate?
An SSL certificate is a small digital file installed on the server that hosts your website. It holds your domain name or names, a public key, the name of the authority that issued it and the dates between which it is valid. It is what allows a site to use HTTPS.
The name is older than the technology behind it. SSL, short for Secure Sockets Layer, was replaced by TLS, Transport Layer Security, which is what browsers and servers use today. Certificates sold as "SSL" or "TLS" certificates are the same product. Most people, including hosting companies, still say SSL, so this guide does too and says TLS where the difference helps.
The certificate does two jobs. It lets the browser and server set up an encrypted connection, and it lets the browser check that the server really is the one for your domain name.
HTTP vs HTTPS: what is the difference?
HTTP is the basic method browsers use to request web pages, and it sends everything as readable text. HTTPS is HTTP carried over TLS, so the same requests and pages travel in encrypted form. The "S" stands for secure. The practical differences are in the table.
| Point | HTTP | HTTPS |
|---|---|---|
| Address begins | http:// | https:// |
| Data on its way to the server | Readable by anyone who can see the traffic, such as on a shared public network | Encrypted, so intercepted data is unreadable |
| Tampering in transit | Possible without anyone noticing | Detected by the browser |
| Identity of the site | Not checked | The browser checks that the certificate matches the domain |
| Browser display | Chrome can mark the page "not secure" | A padlock or similar indicator, which varies by browser |
MDN, the web documentation site maintained by Mozilla and its contributors, describes TLS as providing encryption, integrity and authentication. In plain words, outsiders cannot read the traffic, nobody can change it unnoticed, and each side can show who it is.
Do you need an SSL certificate?
Yes. Nearly every website needs an SSL certificate now, including a simple brochure site with no forms. Four reasons stand out.
- Any page that takes a login, a form entry or a payment sends personal data, and that data should be encrypted on its way to you.
- Browsers can warn visitors about pages served over HTTP. Google's own guidance says Chrome can mark HTTP sites as not secure, which does little for trust.
- Payment providers and many other online services expect a secure connection. Check their current documentation before you integrate one.
- Google recommends HTTPS. It announced in 2014 that it uses HTTPS as a very lightweight ranking signal, and its documentation says that when the same content exists at an HTTP and an HTTPS address, it typically indexes the HTTPS one, provided the page meets some conditions that include a valid certificate.
Do not expect a certificate to move you up the results by itself. Treat it as a basic requirement, like a working contact form. Whether the law requires encryption for a given kind of data differs by country, so ask a lawyer if you handle sensitive information.
What happens when a visitor opens an HTTPS page
The process takes a fraction of a second and needs nothing from the visitor.
- The browser asks for an address beginning with https:// and says it wants a secure connection.
- The server sends back its certificate.
- The browser checks that the certificate was issued by an authority it trusts, that it covers the domain name in the address, and that it has not expired.
- If the checks pass, the browser and server agree on keys for this visit.
- The page, form entries and everything else travel encrypted with those keys.
If any check in step three fails, the browser shows a warning page and waits for the visitor to decide, which is what you see when a certificate has expired or does not match the name.
Types of SSL certificate
Certificates differ in how much checking the issuing authority did and in how many names they cover. They do not differ in whether the connection is encrypted.
| Type | What the authority checks | Note |
|---|---|---|
| Domain validated | That the applicant controls the domain name | The usual choice for small business sites |
| Organisation validated | The domain, and that the organisation exists | Organisation details are held in the certificate |
| Extended validation | A fuller check of the organisation | How browsers show this level varies and changes, so check current behaviour before paying for it |
| Self-signed | Nothing, since you sign it yourself | Browsers do not trust it, so use it only for testing or private systems |
Coverage is a separate choice. A single-name certificate covers one address. A multi-name certificate lists several. A wildcard certificate covers every subdomain at one level of a domain, such as shop.example.com and blog.example.com. Choose the coverage that matches the addresses you actually use.
Where to get an SSL certificate
Most business owners never buy one directly. Hosting companies and hosted store or builder platforms usually include a certificate and install it, and some renew it automatically. Ask your host what is included, whether renewal is automatic, and which names are covered.
If you manage your own server, you can get a certificate from a certificate authority. Some authorities issue certificates at no charge through an automated standard, and others sell them. Paid options usually differ in validation level, coverage and support, not in how strongly the connection is encrypted. Weigh those differences against what your site needs and the renewal effort each option involves.
A certificate is issued for a domain name and installed on the hosting, so the three pieces need to line up. The guide to domain name, website and hosting explains how they connect and who should own each.
How to set up HTTPS on a site
Installing the certificate is only the first step. A full move to HTTPS has several parts.
- Install the certificate on the server, or ask the host to switch it on. This is a server task and not a design one, so it belongs with your developer or host. The guide to web design, UI and UX design explains why those roles do not cover it.
- Redirect every HTTP address to its HTTPS twin. Google recommends 301 redirects for this.
- Update internal links, your sitemap and canonical tags to HTTPS addresses.
- Fix mixed content. This is a secure page that loads some files over plain HTTP. MDN says browsers upgrade image, video and audio requests where they can and block other insecure types, which can leave a page looking broken.
- Check the HTTPS report in Google Search Console, which shows whether Google sees your pages as served securely.
- Consider HSTS, a setting that tells browsers to use only HTTPS for your site. Google advises turning it on only once you are sure you can avoid certificate validation errors, because browsers then insist on a valid certificate.
Take a copy of the site before changing server settings. The guide to what to back up lists what a copy should contain.
How to check your SSL certificate
Click the padlock or site information icon next to the address in your browser. The menu differs between browsers and changes over time, but it leads to details of the certificate: who it was issued to, who issued it and the dates it is valid between.
Then test the addresses people actually use. Open the home page with and without www, any subdomains such as a shop or booking page, and a page with a form. Try a phone as well. A certificate that covers one name does not cover another, and a mismatch shows as a warning on exactly the page you forgot to check.
Add HTTPS to your launch and maintenance checks, next to checks such as the website accessibility checklist. A site that loads securely but cannot be used with a keyboard or screen reader still shuts out some visitors.
What happens if my SSL certificate expires?
Browsers show a full-page warning to visitors, saying that the connection is not private or the site is not secure. Some visitors will turn back, and those who continue must click through extra options. Forms and payment connections that depend on the certificate may fail, and so can other services that call your site. Google's documentation lists a valid certificate among the conditions for preferring the HTTPS version of a page in its index.
To fix it, renew the certificate, install it on the server, and load the site in a private window to confirm the warning has gone. If a content delivery network sits in front of the site, check it serves the new certificate too.
To prevent it, confirm who renews the certificate and whether renewal is automatic. Authorities and hosts usually send reminders to the contact email on record, so keep that address current and watched. Add the expiry date to a calendar as a second line of defence.
Common certificate and HTTPS problems
| Problem | What you see | Usual cause |
|---|---|---|
| Expired certificate | Full-page browser warning | Renewal failed or was never set up |
| Name mismatch | Warning that the certificate belongs to a different name | The certificate does not cover the address, such as www or a subdomain |
| Mixed content | A broken padlock, or missing images and styling | Some files still load over HTTP |
| Redirect loop | A "too many redirects" error | Conflicting HTTPS rules at the server, the platform or a content delivery network |
| Untrusted issuer | Warning about an unknown authority | A self-signed certificate, or an incomplete installation |
A padlock has limits. It shows that the connection is encrypted and that the domain matches the certificate. It does not show that the business is honest or that the site itself is free of weaknesses, because a fake or hacked site can also have a valid certificate. Protecting the site takes a wider set of habits. The website development service page describes the work Liftup does.
Questions and answers
What is an SSL certificate?
An SSL certificate is a digital file installed on your web server. It lets the site use HTTPS, so data between a visitor and the server is encrypted and the browser can check that the server matches your domain name. Modern certificates use TLS, the successor to SSL.
What is the difference between HTTP and HTTPS?
HTTP sends pages and form entries as readable text. HTTPS carries the same traffic over TLS, so it is encrypted, protected against unnoticed changes and tied to a checked identity. Browsers can mark HTTP pages as not secure.
What happens if my certificate expires?
Browsers show visitors a full-page warning, and some will leave. Forms, checkout and other services that rely on the certificate may also fail. Renew and install a new certificate, test in a private window, and set up automatic renewal and a calendar reminder.
Do I need an SSL certificate if I do not sell anything?
Yes, in nearly every case. Browsers can warn about HTTP pages, contact forms send personal details, and Google recommends HTTPS. A brochure site with no forms still benefits from the warning-free padlock and the secure connection.
Is SSL the same as TLS?
TLS is the successor to SSL, and the name SSL is now mostly a habit. Certificates sold as SSL certificates use TLS in practice. The two names refer to the same product for a website owner, so you will see both used.
Does HTTPS help SEO?
Google has said it uses HTTPS as a very lightweight ranking signal, and it typically indexes the HTTPS version when a page exists at both addresses and meets its conditions. Treat HTTPS as a basic requirement, not a way to climb the results.
Is a free certificate as good as a paid one?
The encryption works the same way. Differences lie in the validation level, the names covered, the support offered and who handles renewal. Check what your host includes before paying for anything extra.