SSL certificates explained
An SSL certificate lets a browser make a private, verified connection to your website. It is what turns http:// into https:// and stops browsers from labelling your site "Not secure".
What a certificate does
When a browser connects to a site over HTTPS, the certificate does three jobs:
- Encryption: the data sent between visitor and website, such as passwords, form entries and payment details, cannot be read by anyone in between.
- Authentication: the certificate proves the server is allowed to use the domain name, so visitors know they reached the real site.
- Integrity: nothing can be changed or injected into the page on its way to the visitor without being detected.
The technology is now called TLS (Transport Layer Security). The older name, SSL, is still widely used for certificates, and this guide uses both to mean the same thing.
Types of certificate
Certificates differ in how much the certificate authority (CA) checks before issuing them, and in how many names they cover. The encryption is the same.
| Type | What is checked | Good for |
|---|---|---|
| Domain validation (DV) | That you control the domain | Most websites, blogs and stores |
| Organization validation (OV) | Control of the domain and that your organization legally exists | Businesses that want their verified company name in the certificate details |
| Extended validation (EV) | A stricter check of the organization | Organizations with specific policy requirements |
By the names they cover:
- Single-name: one name, often with
wwwadded, such asexample.comandwww.example.com. - Wildcard: every subdomain at one level, such as
*.example.comforshop.example.comandmail.example.com. It does not cover deeper names likea.b.example.com. - Multi-domain (SAN): a list of different names in one certificate.
Certificates expire, and lifetimes are getting shorter
Every certificate has an end date. After it, browsers show a full-page warning instead of your site.
The CA/Browser Forum, which sets the rules for publicly trusted certificates, is reducing the maximum lifetime in stages:
| Certificates issued from | Maximum lifetime |
|---|---|
| 15 March 2026 | 200 days |
| 15 March 2027 | 100 days |
| 15 March 2029 | 47 days |
With lifetimes this short, renewing by hand is no longer practical. Use automatic renewal wherever you can. Most hosting providers renew the certificates they issue for you automatically, using a standard protocol called ACME. If you install certificates yourself, set up an ACME client on the server or a reminder well before every expiry date.
Make your whole site use HTTPS
A certificate alone is not enough. Check these too:
- Redirect HTTP to HTTPS. Visitors who type
example.comor follow an old link should land onhttps://. Many control panels and apps have a setting for this. - Fix mixed content. If an HTTPS page loads images, scripts or styles over
http://, browsers block them or show a warning. Update those links tohttps://. In WordPress and similar apps, check that the site address setting starts withhttps://. - Cover
wwwand the apex. Make sure the certificate includes bothexample.comandwww.example.comif visitors use both.
HSTS is a header that tells browsers to use only HTTPS for your domain for a set time. It is a good protection, but once a browser has seen it, the site is unreachable over plain HTTP until that time passes, even if your certificate breaks. Turn it on only when HTTPS works reliably everywhere on your domain, and start with a short duration.
Common certificate errors
| What the browser says | Usual cause | Fix |
|---|---|---|
| The certificate has expired | Renewal did not happen | Renew it and check why automatic renewal failed |
| The name does not match | The certificate does not cover this exact name, often www or a subdomain | Issue a certificate that includes the name |
| The issuer is not trusted, or the chain is incomplete | An intermediate certificate is missing on the server | Install the full chain your CA provides |
| The connection is not private, on one device only | The device's date and time are wrong | Correct the clock on that device |
| Renewal fails after adding DNS records | A CAA record does not allow your CA | Add your CA to the CAA record, or remove it |
DomainPilot web hosting plans include free SSL. For organization validation or wildcard certificates, see SSL certificates on the DomainPilot website.
Sources
- CA/Browser Forum: Baseline Requirements for TLS server certificates
- ACME protocol: RFC 8555