What Is an SSL Certificate? How It Works
What is an SSL certificate? How HTTPS works, SSL vs TLS, DV, OV and EV certificates, whether free SSL is enough and how to install a certificate.
An SSL certificate is a digital document that proves a website's identity and lets the connection between the visitor and the server be encrypted. If you see https:// in your browser's address bar, the site uses an SSL certificate. So what is an SSL certificate for, in short? It stops passwords, form data and card numbers from being read or changed on the way, and it tells the browser that the site really belongs to that domain.
This guide explains how SSL works, the difference between SSL and TLS, the types of certificates, whether free SSL is enough and how to install a certificate on your site.
What does an SSL certificate do?
An SSL certificate provides three things:
- Encryption. Everything between the browser and the server is encrypted. Someone on the same café Wi-Fi, or a network device in between, cannot read passwords or form data.
- Authentication. The certificate is signed by a trusted certificate authority (CA). The browser checks that signature to make sure the server really belongs to the domain.
- Integrity. Data cannot be changed in transit. On plain HTTP sites, internet providers or attackers can inject ads or malicious code; HTTPS prevents that.
There are practical reasons too. Chrome, Firefox and Safari show a "Not secure" warning on pages without HTTPS. Google uses HTTPS as a ranking signal. And faster protocols such as HTTP/2 and HTTP/3 only work over HTTPS in browsers.
How does SSL work?
When a visitor opens https://yourcompany.com, a short handshake happens before the page loads:
- The browser connects to the server and lists the encryption methods it supports.
- The server sends its SSL certificate. It contains the domain name, validity dates, the server's public key and the authority that signed it.
- The browser checks the certificate: is it signed by an authority it trusts, has it expired, does it cover this domain?
- If everything checks out, the browser and server agree on a session key that is valid only for this connection.
- All further data is encrypted with that key.
With TLS 1.3, the handshake completes in a single round trip, so visitors don't notice it at all.
SSL vs TLS
SSL (Secure Sockets Layer) was the first encryption protocol for the web, developed in the 1990s. Every SSL version turned out to have serious flaws, so it was replaced by TLS (Transport Layer Security). HTTPS connections today use TLS 1.2 or TLS 1.3; SSL 3.0 and TLS 1.0 and 1.1 are no longer supported by browsers.
Technically, then, what we use today is TLS. But "SSL certificate" stuck, so providers, control panels and users still use the name. The certificate is the same thing under either name.
Types of SSL certificates
Certificates come in three types, depending on what the certificate authority checks:
| DV (Domain Validated) | OV (Organization Validated) | EV (Extended Validation) | |
|---|---|---|---|
| What is checked | Control of the domain | Domain and that the company exists | Domain and in-depth company checks |
| Time to issue | Minutes | A few days | Days to weeks |
| Encryption | The same | The same | The same |
| Cost | Free options available | Paid | Paid |
| Typical use | Blogs, business sites, most sites | Companies, corporate portals | Banks, large online shops |
The key point: all three use the same encryption. They differ in how thoroughly the identity in the certificate is checked. Browsers no longer show EV certificates differently in the address bar, so a DV certificate is enough for the vast majority of sites.
Certificates also differ by what they cover:
- Single domain: only
yourcompany.com, usually pluswww.yourcompany.com. - Wildcard: every subdomain of one domain, such as
*.yourcompany.com. - SAN / multi-domain: several different domains in one certificate.
Is free SSL enough?
For most sites, yes. Let's Encrypt is a non-profit certificate authority that issues free DV certificates automatically. They provide the same encryption as paid DV certificates and work in every browser. Control panels such as cPanel and DirectAdmin install free certificates automatically and renew them before they expire.
A paid certificate usually makes sense when a contract or regulation requires your company details to be verified in the certificate, when the warranty or support from the certificate vendor matters to you, or when you use a system that cannot renew certificates automatically.
Certificate lifetimes are getting shorter
The maximum lifetime of public SSL certificates is set by joint rules from browser vendors and certificate authorities. Since 15 March 2026 it has dropped from 398 to 200 days, and it will shrink step by step over the next few years. Let's Encrypt certificates already last 90 days. The upshot: renewing certificates by hand is no longer practical, so use hosting or a server setup that renews them automatically.
How to install an SSL certificate
On web hosting:
- Make sure your domain's DNS points to your hosting server. The certificate authority needs to reach your server to validate the domain.
- Enable the free certificate under SSL/TLS Status in cPanel or SSL Certificates in DirectAdmin. In most cases this happens automatically.
- Open the site with
https://and check for the padlock.
On your own VPS: if you use Nginx or Apache, the Certbot tool gets a Let's Encrypt certificate and sets up automatic renewal with one command:
sudo certbot --nginx -d yourcompany.com -d www.yourcompany.com
Certbot obtains the certificate, updates the web server configuration and adds a renewal timer.
After installing
- Redirect HTTP to HTTPS. Visitors who arrive on
http://should be sent tohttps://automatically. Control panels usually have a single "Force HTTPS" setting for this. - Fix mixed content. If images, scripts or stylesheets on the page still load from
http://addresses, the browser warns about or blocks them. In WordPress, updating the site address tohttps://fixes most cases. - Check www and non-www. The certificate should cover both addresses, and one should redirect to the other.
- Monitor the expiry date. Even with automatic renewal, renewal can fail if your domain's DNS changes. A monitoring tool warns you before the certificate expires.
Common SSL errors
- "Your connection is not private" (NET::ERR_CERT_DATE_INVALID): The certificate has expired, or the visitor's computer clock is wrong.
- "NET::ERR_CERT_COMMON_NAME_INVALID": The certificate doesn't cover the domain being visited, for example it was issued for
yourcompany.combut the site opens onwww.yourcompany.com. - A warning sign instead of the padlock: The page has mixed content.
- Incomplete certificate chain: Some devices can't find the intermediate certificate. Install the full chain (fullchain) when you set up the certificate.
SSL is only one part of your site's security. To protect your email against spoofing, read SPF, DKIM and DMARC explained; to protect your server against attacks, see What is a DDoS attack?
Every Nodesty web hosting plan includes a free SSL certificate. Once your domain points to your hosting, enable the certificate in cPanel or DirectAdmin and serve your site over HTTPS.
Frequently Asked Questions
Is a free SSL certificate safe?
Yes. Free certificates such as Let's Encrypt provide the same encryption as paid DV certificates and are trusted by every browser. Paid certificates differ in extras like organization validation, warranties and support, not in encryption.
How long is an SSL certificate valid?
The maximum validity of public SSL certificates is set by industry rules and keeps getting shorter. Since 15 March 2026, new certificates can be valid for at most 200 days, and that will drop further over the coming years. Let's Encrypt certificates last 90 days. Automatic renewal is now a must.
Are SSL and TLS the same thing?
In everyday use they mean the same thing. SSL is the old name of the technology, and every SSL version is now considered insecure. HTTPS connections today are encrypted with TLS 1.2 or TLS 1.3, but certificates are still commonly called SSL certificates.
Why does my site still say Not secure after installing SSL?
The most common cause is mixed content; the page loads over HTTPS but some images or scripts are still loaded from http:// addresses. The certificate may also have expired or may not cover the address visitors use, such as the www version.
Can one certificate cover several domains?
Yes. SAN certificates cover several different domains, and wildcard certificates cover all subdomains of one domain (for example *.yourcompany.com) with a single certificate. Wildcard certificates require validation through the domain's DNS records.
Do Nodesty web hosting plans include SSL?
Yes. Every Nodesty web hosting plan includes a free SSL certificate. Once your domain points to the hosting server, you can enable it from the control panel and serve your site over HTTPS.
About the author
Nodesty Team · Infrastructure & Support
The Nodesty team runs our servers, network and DDoS protection day to day and answers customer support requests around the clock. These guides come from that work.
Related articles
Website Hacked? What to Do, Step by Step
Website hacked? What to do: the signs, first response, passwords, finding malicious files, restoring a clean backup, WordPress cleanup and prevention.
Linux Server Security: A Step-by-Step Checklist
A Linux server security checklist: automatic updates, SSH keys, a firewall, Fail2ban, unneeded services, isolation, backups and security audits.
How to Set Up WireGuard: Run Your Own VPN Server
How to set up WireGuard as your own VPN on an Ubuntu server: generating keys, wg0.conf, IP forwarding and NAT, client settings and QR codes for phones.