SSL Certificates in Plain English: What They Do and What They Do Not

An SSL certificate is the least controversial security control on the internet, and also the most misunderstood. It encrypts traffic. It does not make a website trustworthy, and it does not stop a site from being hacked.

What a certificate actually does

Two things:

1. Encryption. Data between the browser and the server is unreadable to anyone in between — useful on public Wi-Fi and mandatory for card payments.
2. Identity binding. It proves the server answering for a domain is authorised to do so, issued by a certificate authority that verified control of the domain.

That is why browsers warn on plain HTTP: without a certificate, a login form can be read or altered in transit.

The validation levels, honestly

Domain validated (DV)

The authority confirms you control the domain — usually through a DNS record or a file. Issued in minutes, free to cheap, and perfectly adequate for most websites. Encryption is identical to more expensive options.

Organisation validated (OV)

The authority also verifies your legal entity exists. Useful where procurement requires evidence of business verification. Takes days and needs paperwork.

Extended validation (EV)

The strictest verification. Browsers no longer show a special green bar, so the practical difference is mostly internal or contractual rather than visible to visitors.

What a certificate does not do

• It does not fix an outdated plugin or a weak password.
• It does not prevent phishing on a lookalike domain.
• It does not guarantee the business is honest.
• It does not remove the need for backups.

Treat HTTPS as table stakes, not as a security strategy.

Wildcard, multi-domain and SAN

A wildcard covers *.example.com in one certificate — convenient when you run many subdomains. A multi-domain certificate covers several different domains. A SAN field is simply the list of names a certificate covers; every modern certificate has one.

The renewal outage

Most certificate incidents are not attacks; they are expired certificates. Free 90-day certificates from Let's Encrypt are excellent, provided renewal is automated. If renewal depends on a person remembering, it will eventually fail at the worst possible time.

Check three things today:

1. Is auto-renew enabled for every domain and subdomain?
2. Will renewal succeed if the server's webroot moves?
3. Do you get an alert at thirty, fourteen and seven days before expiry?

Installing and verifying

After installation, verify with a TLS checker and confirm:

• The chain is complete, including intermediates.
• TLS 1.2 and 1.3 are enabled; older versions are disabled.
• HTTP redirects permanently to HTTPS.
• Mixed content warnings are gone — every image, script and font loads over HTTPS.

Choosing for a small business

Start with a DV certificate and automate renewal. Move to OV only when a customer or auditor asks. Spend the saved budget on backups, monitoring and two-factor authentication, which reduce real risk far more than a higher validation tier.

What to check on every new host

When you move hosting, the certificate usually moves with it, which is exactly when coverage breaks. After any migration:

• Confirm the new server serves the certificate for the apex domain and every www variant you use.
• Re-test the certificate chain. A missing intermediate shows a warning in some browsers but not others.
• Check that HTTP Strict Transport Security is enabled only after HTTPS works everywhere.
• Update any monitoring that watched the old certificate path.

The Let's Encrypt documentation explains the automatic renewal model clearly, and it is the model worth copying even if you buy commercial certificates.

A five-minute audit

Open your site in a private window, click the padlock, and confirm the certificate covers the exact hostname, is currently valid, and uses a modern chain. Then repeat for your checkout or login subdomain. Most teams find at least one neglected hostname on the first pass — often the one that sends email or handles payments.

Compare coverage options on our SSL certificates page, or read more security guides.