An SSL certificate is a small file on the server that confirms who runs a site and lets the connection with each visitor be encrypted (the address starts with https://). Every site needs one today: it is free, Google expects it, and browsers warn people about sites without it. Installing, renewing and monitoring certificates is part of our website maintenance.
Everything you need to know about SSL certificates
An SSL (now TLS) certificate encrypts the link between your site and its visitors. Which to choose, how to install it and why renewal must be automatic.
By
6 min read
Published on
Updated:
In short
- Name: we still say “SSL”, but the protocol is now TLS (versions 1.2 and 1.3); the old SSL versions were retired long ago.
- Cost: for most sites a free Let’s Encrypt certificate, issued automatically by the host, is enough.
- Lifetime: since 15 March 2026 certificates last at most 200 days, falling to 47 days in 2029, so renewal must be automatic.
- Browsers: Chrome labels HTTP pages “Not secure”, and Google announced that from Chrome 154 (October 2026) it warns by default before opening a public site without HTTPS.
What is an SSL certificate, and how does it work?
It is a digital certificate that vouches for a site’s identity and allows the data between the site and the browser to be encrypted. SSL (Secure Sockets Layer) was the original protocol; its successor TLS (Transport Layer Security), in versions 1.2 and 1.3, does the job today, and browsers reject SSL and the early TLS 1.0 and 1.1.
When someone opens your site, the browser checks that the certificate comes from a trusted issuer, matches the domain and is in date. If it does, browser and server agree keys and encrypt the connection, so nobody on the way, on public Wi-Fi for example, can read or alter the data.
Why it matters
- It protects visitors’ data: passwords, form and order details, personal information.
- It keeps their trust: pages without HTTPS are marked “Not secure”, and HTTPS-by-default warnings are coming to every Chrome user.
- It helps in Google: HTTPS has been a light ranking signal since 2014.
- It unlocks modern features: HTTP/2 and many browser features work only over HTTPS.
The padlock never meant a site was trustworthy, only that the connection was encrypted; since Chrome 117 (September 2023) a neutral site-settings icon has replaced it.
Choosing the right certificate
Certificates differ in how much the issuer checks the owner, not in the strength of encryption.
| Type | What the issuer checks | Who it is for |
|---|---|---|
| DV (domain validated) | that you control the domain | almost every site and shop; free from Let’s Encrypt |
| OV (organisation validated) | the domain and the company | companies that want their details in the certificate |
| EV (extended validation) | the domain, the company and its documents | banks and large firms whose policies require it |
Chrome and Firefox stopped showing the EV company name in the address bar in 2019, so EV no longer gives visitors a visible signal.
How to install it
Most hosts now issue and renew a free certificate automatically (cPanel calls it AutoSSL); check your control panel first. Then:
- Redirect HTTP to HTTPS with a permanent (301) redirect.
- Change the site address in WordPress to
https://(Settings › General) and fix old internal links and images, so there is no mixed content. - Turn on HSTS once everything works, so browsers remember to use HTTPS only.
- Test it with a free checker such as Qualys SSL Labs, and open a few pages to make sure there are no warnings.
For a paid OV or EV certificate, generate a CSR in your control panel (in cPanel: SSL/TLS), send it to the issuer (for example GlobalSign, DigiCert or Sectigo), then install the certificate you receive under “Manage SSL sites” and redirect to HTTPS as above.
Why renewal must be automatic
In April 2025 the CA/Browser Forum, the body of certificate issuers and browser makers, passed ballot SC-081: the maximum lifetime falls from 398 to 200 days from 15 March 2026, to 100 days from 15 March 2027 and to 47 days from 15 March 2029. Let’s Encrypt also stopped sending expiry reminder e-mails on 4 June 2025. Renewal therefore has to run automatically (over the ACME protocol), and someone has to check that it worked.
Frequently asked questions
Is a free certificate worse than a paid one?
Not for encryption: a free Let's Encrypt certificate protects the connection just as well. Paid OV and EV certificates add verified company details to the certificate, but browsers no longer show them in the address bar.
How long is a certificate valid?
From 15 March 2026, at most 200 days; from 15 March 2027, at most 100 days; from 15 March 2029, at most 47 days (CA/Browser Forum ballot SC-081). Let's Encrypt certificates last 90 days by default. Renewal has to be automatic.
Do I need an EV certificate for an online shop?
Usually not. Card details are entered on the payment provider's secure page or form. A valid certificate, HTTPS everywhere and regular updates are what the shop needs.
What happens if the certificate expires?
Browsers show a full-screen warning and most visitors leave. That is why we monitor certificate and domain expiry as part of website care.
