In short
An SSL certificate, more precisely a TLS certificate, is a file issued by a trusted certificate authority that ties your domain to a cryptographic key, letting browsers verify they are talking to your server and encrypt the connection; it is what makes HTTPS and the padlock work. You do not have to pay for one: Let's Encrypt and other authorities issue domain-validated certificates free, they are exactly as secure as paid ones, and nearly every host installs and renews them automatically. Paid certificates make sense only for organisation validation requirements, wildcard or multi-domain convenience on some hosts, or a support contract.
What a certificate does
When a browser connects to a site over HTTPS, two things have to happen: the browser must confirm it has reached the genuine server for that domain and not an impostor, and the two must agree on keys to encrypt everything they exchange. The certificate handles the first. It is a small file, signed by a certificate authority the browser already trusts, stating that the holder of a particular private key is entitled to serve this domain. The browser checks the signature, checks the domain matches, checks the dates, and then proceeds to set up encryption using the key.
The protocol is TLS; SSL was its predecessor, retired years ago for security reasons, and the name stuck. "SSL certificate" and "TLS certificate" mean the same thing today.
Without a valid certificate, browsers show the "Not Secure" label or a full-page warning, with the consequences that follow.
How you get one
A certificate authority has to confirm you control the domain before issuing. For the standard type, domain validation, that means responding to a challenge: placing a file at a specific URL on the site, or adding a DNS record. Automated tools do this in seconds through the ACME protocol, which is how hosts issue certificates without anyone clicking anything.
Certificates expire. Let's Encrypt certificates last 90 days; paid ones traditionally lasted a year, and browser policy has been shortening the maximum. Short validity is a feature, since it limits the damage of a stolen key, and it makes automated renewal essential. A host or a server with ACME configured renews well before expiry; a manually installed certificate is a scheduled outage waiting for someone to forget.
The validation levels
Domain validated (DV). Proves control of the domain, nothing more. Issued in minutes, automatically, free from Let's Encrypt, ZeroSSL and others. This is what almost every website needs and uses.
Organisation validated (OV). The authority also checks that the organisation named in the certificate exists and controls the domain, through business registration records. Costs money, takes days, and the result is visible only to someone who inspects the certificate details. Encryption is identical.
Extended validation (EV). A more rigorous organisation check. Browsers once displayed EV certificates with a green bar and the company name; Chrome, Firefox and Safari removed that indicator in 2019 because studies showed users did not notice it. EV now offers nothing visible, and its market has shrunk accordingly.
The important fact: all three levels provide the same encryption. The differences are in what was verified about the organisation, and browsers no longer surface that difference to visitors.
Why free is as good as paid
Let's Encrypt, launched in 2015 by a non-profit backed by Mozilla, the EFF, and major internet companies, issues DV certificates free and automatically, and now secures a large majority of the web. Its certificates are trusted by every browser and device, use the same cryptography as any paid certificate, and are renewed by software. The result is that the padlock, which once cost $50 to $300 a year, costs nothing.
What paid certificate vendors offer instead: OV and EV validation for organisations that require it, longer validity where policy still allows it, wildcard and multi-domain certificates with a support team to help configure them, warranties that pay out in circumstances that essentially never occur, and a phone number. None of these makes a visitor safer.
When paying makes sense
A compliance or contractual requirement for OV or EV. Some industries and some enterprise customers specify it. If yours does, you know.
Hosting that does not support automated free certificates. Rare now, and a reason to change host rather than to buy a certificate.
Complex setups with many subdomains or domains where a wildcard or SAN certificate from a vendor with support is simpler than automating ACME across everything. Let's Encrypt issues wildcards too, via DNS validation, so this is convenience rather than necessity.
Code signing, email signing, or client certificates, which are different products from web server certificates.
For a business website, none of these usually applies, and the correct amount to spend on the certificate is zero.
Practical checklist
- Confirm the host or platform issues and renews certificates automatically; nearly all do.
- Check the certificate covers both
wwwand the bare domain. - Redirect all HTTP to HTTPS and enable HSTS once everything works.
- Put the expiry date in a monitoring tool anyway, in case automation breaks.
- Ignore upsells at domain checkout for "SSL protection".
The certificate is one line item in securing a site, and the only one that has become free. If you are being quoted for one, book a call before paying; the answer is usually that your host already provides it.
Common questions
Is a free SSL certificate safe?
Yes. Free domain-validated certificates from Let's Encrypt and similar authorities use the same cryptography and are trusted by the same browsers as paid certificates. The encryption is identical. Paid certificates differ only in organisational validation, validity length, support and warranties, none of which affects the security of the connection.
How much does an SSL certificate cost?
Nothing, for the domain-validated certificates almost every website needs; Let's Encrypt issues and renews them free, and most hosts automate it. Paid certificates run from around $10 to several hundred dollars a year for organisation or extended validation, wildcards with support, or longer validity, which are rarely needed for an ordinary business site.
What is the difference between SSL and TLS?
TLS is the current protocol for encrypting web connections; SSL was its predecessor, deprecated years ago because of security flaws. The name SSL persisted in everyday use, so 'SSL certificate' and 'TLS certificate' refer to the same thing today. Modern servers should support only TLS 1.2 and 1.3.
How long does an SSL certificate last?
Let's Encrypt certificates last 90 days and are renewed automatically; paid certificates have traditionally lasted one year, and browser policy is shortening the maximum validity. Short lifetimes are a security feature. Whatever the length, renewal should be automated and the expiry date monitored, since an expired certificate takes the site down.
Do I need an EV certificate for my business website?
Almost certainly not. Extended validation once showed a green bar with the company name in browsers, but Chrome, Firefox and Safari removed that indicator in 2019 because users did not notice it. EV now provides no visible benefit and the same encryption as a free certificate. Buy it only if a regulator, contract or customer specifically requires it.
