What Is an SSL Certificate and Why Is It Important?

Published October 24, 2026 · Last updated October 24, 2026 · By the WebSolutions LLC team

If your website address starts with https:// and the browser shows no warning, your site is using an SSL certificate. Most people never think about it until something goes wrong: a certificate expires, visitors see a full-page security warning and enquiries stop. This guide explains what an SSL certificate is in plain language, how it works, why every business website needs one, the different types, what "free" really means, and how to fix the errors you are most likely to meet.

What is an SSL certificate?

An SSL certificate is a small data file, installed on your web server, that proves your website is really the domain it claims to be and lets the browser set up an encrypted connection with it. It contains your domain name (or names), a public key, the dates it is valid for and a digital signature from the certificate authority (CA) that issued it. Browsers trust a set of certificate authorities, so when your certificate is signed by one of them, the browser accepts it without a warning.

The name is historical. SSL (Secure Sockets Layer) was the original protocol, but it has been replaced by TLS (Transport Layer Security). The IETF requires that SSL 3.0 is no longer used (RFC 7568), and it has formally deprecated TLS 1.0 and 1.1 as well (RFC 8996). Modern sites use TLS 1.2 and TLS 1.3 (RFC 8446). People still say "SSL certificate" out of habit; the correct term is a TLS certificate, and it is the same product (MDN: TLS).

How an SSL certificate works, in plain terms

Every time someone opens a page on an HTTPS site, a short exchange happens before any content is sent:

1. The browser connects to your server and asks for a secure connection.
2. The server sends its certificate.
3. The browser checks that the certificate was issued by a trusted certificate authority, that it has not expired, and that the domain in the address bar is listed in it.
4. If all checks pass, the browser and server agree on encryption keys for the session, and the page loads over the encrypted connection.

If any check fails, the browser stops and shows a warning instead of your page. That is why an expired or misconfigured certificate is so damaging: most visitors will not click past a security warning.

Why an SSL certificate is important

• Privacy. Encryption stops anyone on the network path, such as a public Wi-Fi operator, from reading what visitors type into your forms, logins and checkout.
• Integrity. HTTPS also stops pages from being changed in transit, so nobody in the middle can inject adverts or malicious scripts into your site.
• Trust and browser labels. Chrome has marked all HTTP sites as "not secure" since Chrome 68 in July 2018 (Chromium Blog). A "not secure" label next to your contact form is not a good first impression.
• Search. Google's page experience guidance lists serving pages over HTTPS among the things site owners should check (Google Search Central: page experience). It will not lift a weak page on its own, but there is no reason to leave it out.
• Modern features. Many browser features only work in secure contexts. For example, only secure contexts can register service workers, which progressive web apps rely on (MDN: secure contexts). Our PWA vs native app guide explains why that matters.

A small brochure site needs HTTPS just as much as a shop. Even a simple contact form sends names, email addresses and phone numbers that visitors expect you to protect.

Types of SSL certificate

Certificates differ in two ways: how much the certificate authority checks before issuing, and how many names the certificate covers.

By validation level

• Domain Validation (DV). The CA only confirms that you control the domain, usually by a file on the web server or a DNS record. DV certificates are issued automatically in minutes and are what most websites use.
• Organization Validation (OV). The CA also checks that the organisation named in the certificate exists. Some companies require OV for policy reasons.
• Extended Validation (EV). A stricter organisation check. Visitors see the same padlock or site-information icon as with DV, so the extra checking is mainly of value where a contract, regulator or internal policy asks for it.

All three levels use the same encryption. The difference is the identity checking behind the certificate, not how well the connection is protected.

By coverage

• Single domain covers one name, for example www.example.com (many CAs include the bare example.com as well).
• Multi-domain (SAN) lists several names in one certificate using the Subject Alternative Name field.
• Wildcard covers every first-level subdomain, such as *.example.com. With Let's Encrypt, wildcard certificates must be validated with the DNS-01 challenge, so your DNS provider needs to support automation (Let's Encrypt FAQ).

Is an SSL certificate free?

It can be. Let's Encrypt is a nonprofit certificate authority that does not charge for its certificates. It issues Domain Validation certificates only and has no plans to offer OV or EV (Let's Encrypt FAQ). Many hosting control panels request and renew these certificates for you, so for a typical business website a paid certificate is not necessary. A paid certificate makes sense when you need OV or EV validation, a specific certificate authority, or support terms that a free option does not provide. If you are comparing hosts, check whether free certificates and automatic renewal are included; our types of web hosting guide lists other things to compare.

How long does an SSL certificate last?

Certificate lifetimes are getting shorter, which makes automatic renewal essential:

• The CA/Browser Forum, which sets the rules public certificate authorities follow, has approved a schedule that cuts the maximum validity of public TLS certificates from 398 days to 47 days, in steps starting in March 2026 and finishing in March 2029 (CA/Browser Forum: Ballot SC-081). The first step is already in force: since 15 March 2026 the maximum validity is 200 days (CA/Browser Forum: Baseline Requirements).
• Let's Encrypt's default certificates are valid for 90 days, and it recommends renewing them every 60 days (Let's Encrypt FAQ). It has announced that it will move its default certificates to 64 days from February 2027 and to 45 days from February 2028 (Let's Encrypt: Decreasing certificate lifetimes to 45 days).

The practical message is simple: do not rely on a calendar reminder. Use your host's automatic certificate feature or an ACME client that renews on its own, and add certificate expiry to the checks in your website maintenance checklist.

How to check your SSL certificate

1. Open your site in a browser and click the icon to the left of the address. Choose the option to view connection or certificate details.
2. Check who issued the certificate, the "valid from" and "valid to" dates, and the list of names it covers. Both example.com and www.example.com should be listed if both versions are used.
3. Open the http:// version of your address and confirm it redirects to the https:// version.
4. Open a few inner pages and check that none show a warning about insecure content.

Common SSL certificate errors and how to fix them

• Certificate expired. Automatic renewal failed or was never set up. Renew it, then find out why the automation failed: often a changed DNS record, a firewall rule or a moved site.
• Name mismatch. The certificate does not list the address the visitor used, typically the www or non-www version. Reissue the certificate to cover both names, and redirect one to the other.
• Incomplete chain. The server sends your certificate but not the intermediate certificate that links it to a trusted root. Some browsers cope, other clients fail with errors such as "unable to get local issuer certificate". Install the full chain file your CA or host provides.
• Self-signed certificate. Fine on a test server, never on a public site. Replace it with a certificate from a public CA.
• Mixed content. The page loads over HTTPS but an image, script or stylesheet still uses http://. Browsers upgrade some of these requests and block others (MDN: mixed content). Update the links to https:// in your templates and content.
• Visitor's clock is wrong. If one person sees an error that nobody else sees, their device date may be wrong, which makes a valid certificate look expired or not yet valid.

After the certificate: finish the move to HTTPS

Installing a certificate is only half the job. Redirect every http:// URL to its https:// version with a permanent redirect, update internal links, canonical tags and your XML sitemap to HTTPS, and check Google Search Console for the HTTPS version of the site. Our website migration checklist covers redirects in detail, and Step 8 of our technical SEO audit checklist shows what to check afterwards. Once everything works over HTTPS, consider the Strict-Transport-Security (HSTS) header, which tells browsers to use only HTTPS for your site in future (MDN: HSTS). You can also publish a CAA record in your DNS to say which certificate authorities may issue certificates for your domain (RFC 8659); our guide to DNS and DNS records explains where that record lives.

HTTPS is one part of keeping a site safe. Our small business website security checklist covers the rest, from account security to backups. If you would like help setting up or fixing HTTPS, see our hosting and security services or contact us.