SSL/TLS certificate

SSL is the old name. The protocol in use today is TLS, its successor, and SSL itself has long been retired for security reasons, but "SSL certificate" stuck as the everyday term. The certificate is what makes HTTPS possible: if it has expired, does not match the domain or was not issued by a trusted authority, browsers show a full-page warning before letting visitors in.

A certificate proves identity and enables encryption; it does not prove a business is honest. Scam sites have valid certificates too, because getting one only requires showing you control the domain. The secure-connection icon in the address bar means nobody can read or alter the traffic in transit, nothing more.

How it works

A certificate links a domain name to a public key and is digitally signed by a certificate authority (CA) that browsers already trust. To get one, the site owner, or more often the host's software, proves control of the domain, usually by placing a file on the site or adding a DNS record. The CA checks it and issues the certificate.

When a visitor connects, the server presents the certificate. The browser checks that it covers the domain being visited, has not expired, and was signed by a trusted CA. If everything matches, the two sides agree on encryption keys and the page loads over an encrypted connection.

Certificates expire and must be renewed. Let's Encrypt, a non-profit CA, issues free certificates through an automated process called ACME, and most hosts renew them automatically. The CA/Browser Forum, the body of certificate authorities and browser makers that sets the rules, has agreed a schedule that cuts the maximum lifetime of public certificates in steps to 47 days by 2029, which makes automatic renewal essential rather than optional. Certificates come in three validation levels, domain, organisation and extended, but modern browsers display them all the same way.

Example

A physiotherapy practice's site shows a warning one Monday morning: the certificate expired over the weekend. The host's automatic renewal had been failing for weeks because the domain's DNS had been moved to another provider and the renewal check could no longer verify control. Fixing the validation method and reissuing the certificate takes minutes; the lost weekend bookings do not come back.

To check your own certificate, click the padlock or site information icon next to the address, open the certificate details and read the expiry date and the names it covers. Free online SSL checkers also report the expiry, the chain and any configuration problems, and some monitoring services will email you before a certificate runs out.

Why it matters for your business

A missing or expired certificate stops most visitors at a warning screen, which means lost enquiries and a damaged first impression. Getting one is usually free and automatic, so there is rarely a reason to pay unless you need a specific type, such as one for an internal system or a business-validated certificate required by a partner. The real risk is not the cost but silent renewal failures, which is why expiry monitoring is worth setting up. Certificates also appear in public certificate transparency logs, so anyone can search which certificates exist for your domain; an unexpected one issued for a subdomain you do not recognise is worth asking your developer about.

Common mistakes

• Paying for a certificate the host would have issued and renewed for free.
• Assuming renewal is automatic without checking that it still works after DNS or hosting changes.
• Covering example.com but not www.example.com or other subdomains in use.
• Telling customers that https means a site is safe to trust, when it only means the connection is encrypted.

Questions people ask

Do I need to pay for an SSL certificate?

Usually not. Free certificates from Let's Encrypt and similar authorities provide the same encryption as paid ones, and most hosts issue and renew them automatically. Paid certificates make sense mainly for special cases, such as organisation-validated certificates a partner requires or systems where automation is not possible.

What happens when an SSL certificate expires?

Browsers show a full-page security warning and most visitors leave. Forms and payments stop working for anyone who does not click through, and some services refuse to connect at all. Renewing or reissuing the certificate fixes it immediately once the new one is installed.

What is the difference between SSL and TLS?

TLS is the modern successor to SSL. SSL versions were retired years ago because of security weaknesses, and today's secure connections all use TLS. People still say SSL certificate out of habit, but the certificates are used with TLS, and the two names refer to the same product.