An SSL certificate — technically TLS (Transport Layer Security) — encrypts the connection between a visitor’s browser and your web server. It is what puts the padlock icon in the address bar and enables HTTPS. Without it, data travels in plain text and can be intercepted by anyone on the network path.
How SSL/TLS Works
When a visitor loads your HTTPS website, a TLS handshake occurs. The browser requests your server’s certificate, verifies it against trusted Certificate Authorities (CAs), and negotiates an encrypted connection. This happens in milliseconds and protects all data exchanged during the session — form submissions, login credentials, payment information, and browsing activity.
Types of SSL Certificates
Domain Validated (DV): The CA verifies that you control the domain — typically through DNS or email verification. Issued in minutes and available for free from Let’s Encrypt. Suitable for most websites, blogs, and small business sites. Shows the padlock but no organisation name.
Organisation Validated (OV): The CA verifies your organisation’s legal existence and domain ownership. Takes 1-3 days. Provides moderate assurance for business websites, portals, and web applications.
Extended Validation (EV): The most rigorous validation — the CA verifies legal existence, physical address, and operational status. Previously showed a green address bar with the company name (most browsers have removed this visual distinction). Primarily used by financial institutions and large e-commerce sites for maximum trust.
Wildcard: Secures a domain and all its subdomains (*.example.com). Cost-effective if you run multiple subdomains.
Multi-domain (SAN): Secures multiple different domains on a single certificate. Useful if your business operates several websites.
Free vs Paid Certificates
Let’s Encrypt provides free DV certificates that are technically identical to paid DV certificates in encryption strength. The differences: paid certificates may offer warranty coverage, longer validity (though maximum validity is now 397 days for all), OV/EV options, and dedicated support. For most websites, Let’s Encrypt is the right choice. Consider paid certificates for e-commerce, financial services, or when you need OV/EV validation.
Installation Steps
For shared/managed hosting: Most modern hosts offer one-click SSL installation through cPanel or their control panel. Many include free Let’s Encrypt certificates with auto-renewal.
For VPS/dedicated servers: Install Certbot (Let’s Encrypt’s official client), run the certificate issuance command for your web server (Apache/Nginx), and configure auto-renewal via cron job. Certbot handles the entire process automatically.
For Cloudflare users: Cloudflare provides a free SSL certificate on their edge servers. Configure “Full (Strict)” mode with a valid origin certificate for end-to-end encryption.
Post-Installation Checklist
After installing your certificate: redirect all HTTP traffic to HTTPS (via .htaccess or server config). Update internal links to HTTPS. Fix mixed content warnings — any HTTP resource loaded on an HTTPS page triggers browser warnings. Update your sitemap URLs. Update Google Search Console with the HTTPS property. Enable HSTS (HTTP Strict Transport Security) to prevent protocol downgrade attacks.
Common Mistakes
Letting certificates expire: An expired certificate displays a browser warning that drives visitors away. Set up auto-renewal and monitor certificate expiry dates.
Mixed content: Loading images, scripts, or stylesheets over HTTP on an HTTPS page. Audit your site for mixed content after enabling HTTPS.
Not redirecting HTTP to HTTPS: If both versions of your site are accessible, you lose the security benefit and create duplicate content for SEO.
Using outdated TLS versions: Disable TLS 1.0 and 1.1. Only support TLS 1.2 and 1.3. Older versions have known vulnerabilities.
Ignoring certificate chain issues: Install the full certificate chain (including intermediate certificates) to avoid trust errors on some devices and browsers.
