The padlock in the browser address bar is something everyone recognizes and almost nobody fully understands. Behind it sits SSL/TLS — the technology that encrypts the connection between a visitor and your website and proves the site is genuinely who it claims to be. Get it right and it is invisible; get it wrong and visitors are greeted with alarming security warnings, or worse, their data travels unprotected. This guide explains what certificates actually do, the types available, and the mistakes that cause the dreaded browser warnings.
What SSL/TLS actually does
SSL/TLS (the modern version is properly called TLS, though everyone still says SSL) does two jobs. First, encryption: it scrambles the data traveling between a browser and your server so that anyone intercepting it — on public Wi-Fi, say — sees only gibberish. Second, authentication: the certificate, issued by a trusted authority, proves the site is really the domain it claims to be, not an impostor. Together these turn http into https and produce the padlock.
The types of certificate
| Type | Validates | Typical use |
|---|---|---|
| Domain Validated (DV) | Control of the domain | Most websites, blogs, small business |
| Organization Validated (OV) | Domain + the organization exists | Business sites wanting extra assurance |
| Extended Validation (EV) | Rigorous organization vetting | Banks, large e-commerce |
| Wildcard | A domain and all its subdomains | Many subdomains under one cert |
| SAN / Multi-domain | Several distinct domains | Multiple sites, one certificate |
For the vast majority of websites, a free DV certificate provides exactly the same encryption strength as an expensive one — the difference is in the level of identity validation, not the security of the connection itself.
Free certificates changed everything
Services like Let’s Encrypt made trusted DV certificates free and automatable, which is why HTTPS is now the default across the web rather than a paid upgrade. These certificates are short-lived by design and renew automatically, so once set up correctly they need no manual attention. For most business websites, a free auto-renewing certificate is the right and sufficient choice.
Why browsers show scary warnings
- Expired certificate. The single most common cause — a renewal that silently failed. Automate renewal and monitor it.
- Name mismatch. The certificate is for one name but the site is served under another (e.g. missing the
wwwvariant). - Self-signed or untrusted issuer. The certificate isn’t from a recognized authority, so browsers don’t trust it.
- Mixed content. An HTTPS page loading some images or scripts over plain HTTP, which breaks the padlock.
- Incomplete chain. Intermediate certificates weren’t installed, so some clients can’t verify trust.
Best practices
- Automate renewal and add expiry monitoring so a cert never lapses unnoticed.
- Redirect all HTTP to HTTPS so visitors always use the secure version.
- Cover every hostname you serve, including
wwwand any subdomains. - Fix mixed content so every resource loads over HTTPS.
- Use strong, modern TLS settings and disable outdated protocols.
- Consider HSTS to enforce HTTPS for returning visitors.
Certificates beyond websites
TLS is not just for public websites. It secures internal applications, mail servers, VPNs, and APIs too. In business environments, expired internal certificates are a frequent and frustrating cause of sudden outages, so the same discipline — inventory, automation, and monitoring — applies everywhere certificates are used.
Frequently Asked Questions
Is a free certificate as secure as a paid one?
For encryption, yes — the connection security is identical. Paid OV and EV certificates add more rigorous identity validation, which some organizations want, but they do not make the connection more secure.
How often do certificates need renewing?
Validity periods have been shrinking, and many free certificates renew every 90 days. This is precisely why automation and monitoring matter — manual renewal on short cycles is easy to forget.
Keep the padlock green, everywhere
Correctly configured, auto-renewing certificates protect your visitors and your reputation without ongoing effort. For help setting up HTTPS, fixing certificate warnings, or managing internal certificates, contact our engineers, or read our office network security guide.