What Is an SSL Certificate? HTTPS Explained

An SSL certificate is a small file on your server that encrypts the connection between your site and its visitors and proves the site is who it claims to be. It is what turns "http" into the secure "https" in the address bar and shows the padlock icon. Without one, browsers now label a site "Not secure" and warn people away. The good news for beginners: a basic SSL certificate is free and usually installed automatically by your host. This guide explains what the certificate actually does, why the name is slightly out of date, and when — if ever — you would pay for one.

What an SSL certificate does

A certificate does two jobs. First, it enables encryption: data travelling between the visitor's browser and your server is scrambled so that anyone intercepting it — on public Wi-Fi, say — sees only gibberish. That protects passwords, form entries and anything else people send you. Second, it authenticates identity: the certificate is issued by a trusted authority and vouches that the site really is at the domain it claims, which is harder for an impostor to fake. Together, encryption and identity are what the padlock represents. It does not mean a site is honest or safe to buy from — only that the connection is private and the domain is verified.

SSL vs TLS: the name is out of date

Almost everyone says "SSL certificate," but the technology is really TLS. SSL (Secure Sockets Layer) was the original protocol; it had serious flaws and was retired years ago, replaced by TLS (Transport Layer Security), now on versions 1.2 and 1.3. The certificate is the same idea, and the industry kept the familiar "SSL" label out of habit, so you will see "SSL," "TLS" and "SSL/TLS" used interchangeably. When a host advertises an SSL certificate, you are getting modern TLS encryption regardless of the wording. HTTPS itself is simply HTTP running over that encrypted TLS connection — the same web, wrapped in a secure layer.

Free certificates and how they work

Most sites use a free certificate, and it is genuinely free, not a trial. Let's Encrypt, run by a nonprofit, issues free domain-validated certificates that most hosts install and renew for you automatically — often branded "free SSL" or "AutoSSL" in the control panel. These certificates last 90 days and renew themselves in the background, so you never think about them. If your host offers this, turning it on is usually one click in cPanel or already done by default. There is no reason to pay for a basic certificate when the free one provides the same encryption and the same padlock.

DV, OV and EV: the certificate types

Certificates come in three validation levels, and the difference is about identity, not encryption strength. Domain Validated (DV) certificates confirm only that you control the domain; they are issued in minutes, are what Let's Encrypt provides, and are right for the vast majority of sites. Organisation Validated (OV) and Extended Validation (EV) certificates additionally verify that a real, registered business is behind the site, which takes paperwork and costs money. All three encrypt the connection identically — a DV certificate is exactly as secure in transit as an EV one. Paid OV and EV certificates mainly make sense for large businesses that want vetted identity on file; a normal site gains nothing in security by buying one.

Do you need to pay for SSL?

For almost everyone, no. Confirm that your host includes free SSL — nearly all do — and enable it, and your site will have HTTPS and the padlock at no cost. Be wary of any host that charges for basic SSL or presents it as a premium add-on; that is a sign of an outdated or overpriced plan, and it is one of the things worth checking when you weigh up what a web host provides. Pay for a certificate only if you specifically need the verified business identity that OV or EV provides — a rare requirement for a first site.

Common SSL warnings and what they mean

Most SSL trouble shows up as one of a few browser warnings, and each points to a specific, fixable cause. A "Not secure" label in the address bar usually means the page is being served over plain http with no certificate at all — either one was never installed, or the site is not forcing visitors onto the https version. The fix is to enable the free certificate and redirect all traffic to https. A full-page "Your connection is not private" warning normally means the certificate has expired, or it does not match the domain being visited; free auto-renewing certificates rarely expire, but a manually installed one can lapse if nobody renews it. A "mixed content" warning — the padlock showing but with a note — means the page itself loads over https while some of its images, scripts or styles still point to http addresses; the browser flags the insecure pieces, and the fix is to update those links to https. Finally, a warning about a self-signed or untrusted certificate means the certificate was not issued by a recognised authority, which is fine for private testing but not for a public site, where a proper certificate from a trusted issuer like Let's Encrypt is needed.

The reassuring part is that on a normal host, almost none of this requires your attention. The host installs a free certificate, renews it automatically, and often forces https for you. If you do see one of these warnings on your own site, it is usually a one-time setting to switch on rather than a sign of a deeper problem, and your host's support can point you to it quickly. The one warning worth acting on the same day is an expired certificate, since visitors are blocked by a full-page alert until it is renewed; everything else tends to be cosmetic or a redirect you can set once and forget. Knowing which warning is which turns a scary red screen into a five-minute fix.