An SSL certificate is a small file on your website’s server. It lets a visitor’s browser confirm it has reached your domain and set up an encrypted connection. That encrypted connection is what turns http:// into https://.

  • An SSL certificate lets a browser confirm it has reached your domain and set up an encrypted https connection.
  • It protects data in transit, such as form entries. It does not protect the site itself from being hacked.
  • DV, OV, and EV certificates all provide the same encryption strength. They differ in how much the issuer verifies about you.
  • Certificates expire, and their maximum lifetime is shrinking, so automatic renewal is the practical setup.

A note on the name: the protocol doing the work today is TLS, the successor to SSL. Many people still say “SSL certificate,” so this guide does too.

An SSL certificate is a small file on your website’s server. It lets a visitor’s browser confirm it has reached your domain and set up an encrypted connection. That encrypted connection is what turns http:// into https://.

A note on the name: the protocol doing the work today is TLS, the successor to SSL. Many people still say “SSL certificate,” so this guide does too.

What an SSL certificate does

It does two jobs: it makes encryption possible, and it identifies your server.

Without encryption, what a visitor types into a form can be intercepted by others on the network path. With it, the data is sealed in transit, like a letter in a sealed envelope instead of an open postcard.

The certificate is also issued for your domain name. That lets the browser confirm that the server answering is the one that controls that domain.

How the connection is set up

Before the page loads, the browser and your server do a quick “handshake.” Visitors never see it.

  1. The browser asks your server for its certificate.
  2. The browser checks the certificate: it was issued by a trusted certificate authority (CA), it has not expired, and it matches the domain being visited.
  3. If it passes, the two sides set up encryption keys, and the rest of the visit is encrypted.

What visitors see

The address starts with https://, and the browser shows an icon you can click for connection details. The icon varies by browser. Chrome replaced its padlock with a “tune” icon starting with version 117, released in September 2023.

An encrypted connection is not a guarantee that a site is safe. Google has said the lock icon is not an indicator of website safety, and the FBI has published guidance saying the same. Phishing sites use HTTPS too.

The three types of certificates

Type What the issuer verifies Notes
Domain Validated (DV) You control the domain The most common type. Fast, and often free and automated.
Organization Validated (OV) Domain control, plus basic business details such as name and location The details appear in the certificate, not in the address bar.
Extended Validation (EV) Domain control, plus a thorough review of the legal entity Used to show the company name in the address bar. Chrome (version 77) and Firefox (version 70) removed that display.

All three provide the same encryption strength. What differs is how much the issuer verifies about you. A DV certificate vouches for your domain only, not for your business. If you don’t need verified business details in the certificate, DV does the job.

Free vs. paid

Free certificates from Let’s Encrypt are DV only. They verify domain control, not business identity. Their default lifetime is 90 days, and Let’s Encrypt has said it will reduce its maximum to 45 days by February 2028. Many hosting providers can install and renew these certificates automatically. Paid certificate options include OV and EV validation, which Let’s Encrypt does not offer.

Why renewal matters more every year

When a certificate expires, browsers show a full-page security warning, such as Chrome’s “Your connection is not private,” before the visitor reaches your page.

The maximum lifetime of public certificates is also shrinking under a CA/Browser Forum rule adopted in 2025: 200 days since March 15, 2026, 100 days from March 15, 2027, and 47 days from March 15, 2029. More renewals per year makes automatic renewal the practical setup.

Do you need one?

Uh, Shyah, you do. For a business website, yes. In October 2025, Google announced that starting with Chrome 154, Chrome would ask visitors for permission before opening a public site that doesn’t use HTTPS. Google has also used HTTPS as a ranking signal since 2014.

What it doesn’t do

A certificate protects data moving between the visitor and your server. It does not protect the site itself from being hacked. Think of an armored truck: it protects the cargo in transit, but it doesn’t guard the building. You still need strong passwords, regular software updates, and a firewall.

How to check any site’s certificate

Click the icon at the left of the address bar and open the connection details. From there you can view the certificate, which lists who issued it and when it expires.

Getting one for your WordPress site

Many hosts include a free certificate and renew it automatically. The work is in the setup: switching the site address to https, redirecting old http links, and fixing “mixed content,” which is a page that still loads images or scripts over http. Browsers can block or flag mixed content, so mistakes here can show warnings or break parts of a page.

At The Affordable Web Guy, we install, configure, and renew SSL on the WordPress sites we host and maintain. Call (720) 780-9998 to talk about your site.

Sources