Term · Security & infrastructure
SSL/TLS certificate
An SSL certificate — technically a TLS certificate, since TLS replaced the older SSL protocol, though the old name stuck — is a digital certificate that enables HTTPS. It lets browsers verify that a website controls its domain and encrypts data exchanged between the browser and the server.
[ 01 ]
Explained
What it does
- Encryption: form data, passwords and payment details cannot be read or altered in transit.
- Authentication: the browser checks that the certificate was issued for this domain by a trusted certificate authority.
- Trust signals: browsers mark non-HTTPS pages as "Not secure".
Types
- Domain validated (DV): confirms control of the domain; quick and often free.
- Organisation validated (OV) and extended validation (EV): include checks of the organisation; browsers no longer highlight them differently for most users.
- Wildcard: covers all subdomains of a domain.
- Multi-domain: covers several domains.
For most business websites, a free DV certificate with automatic renewal is sufficient.
Renewal
Certificates expire and must be renewed; industry lifetimes have been shortening. Automatic renewal plus expiry monitoring prevents the full-page browser warning that appears when a certificate lapses. See 24/7 monitoring.
Common problems
- Expired certificates after failed renewal.
- Certificates not covering
wwwor a subdomain. - Mixed content: insecure resources on secure pages.
- Redirect loops between HTTP and HTTPS.
[ 02 ]
FAQ
Frequently asked questions
Are free certificates as secure as paid ones?
Yes, in terms of encryption. Paid certificates may add validation of the organisation, warranties or support.
Does HTTPS make a site secure?
It secures the connection. Site security also requires updates, access control and other measures.