Guides SSL / TLS
What is an SSL/TLS certificate?
When you visit a website over `https://`, you see a padlock (Chrome replaced it with a neutral icon in 2023): the connection is encrypted and the server has proven it really is who it says. That's handled by a TLS certificate (formerly called 'SSL', the name stuck). The certificate is issued by a trusted Certificate Authority (CA), which verifies that you really control the domain. Without a valid certificate, visitors get a big warning and bounce.
SSL or TLS: what's the difference?
Strictly speaking, SSL is the old, now-insecure predecessor, and TLS the modern successor we use today. In practice people still say 'SSL certificate' but always mean TLS. Several TLS versions exist (1.2 and 1.3 are current). Older versions are deprecated. For you as a user, what matters most is that your certificate is valid and your server offers a recent TLS version.
How it works
When you visit your site, your server sends the certificate along. The browser checks three things: was it issued by a trusted CA, is it valid for this domain, and hasn't it expired yet? If all is well, an encrypted connection is set up and the padlock appears.
The certificate proves identity. The encryption ensures no one along the way can read or alter the content.
Validity and renewal
Certificates have a short lifetime, and it's only getting shorter: since March 2026 a new certificate can last at most about 200 days, and that maximum steps down to 47 days in 2029. Free certificates from Let's Encrypt last 90 days. That's why automatic renewal is the norm: services like Let's Encrypt renew the certificate automatically via your server or hosting. If that automation breaks, the certificate expires and visitors get a warning page instead of your site.
So keep an eye on the expiry date, especially for certificates you manage by hand.
CA, CAA and CT logs
A few terms you'll come across:
- CA (Certificate Authority): the party that issues the certificate, e.g. Let's Encrypt or DigiCert
- CAA: a DNS record declaring which CAs may issue for your domain (see the CAA guide)
- CT logs (Certificate Transparency): public logs in which every issued certificate is recorded. They let you check whether certificates for your domain were issued that you don't know about. That's a useful signal against abuse.
Common problems
- The certificate has expired (the automatic renewal broke)
- The certificate is for the wrong name: you have one for
example.combut visitors land onwww.example.com(or vice versa) - A 'mixed content' warning: your page loads over
httpsbut still pulls some parts overhttp - An outdated TLS version or weak settings that browsers reject
Most of these show up immediately as a warning or a missing padlock.
Frequently asked questions
Is SSL the same as TLS?
Colloquially, yes. Technically SSL is the old, insecure predecessor and TLS the modern version. Everyone says 'SSL' but means TLS.
Do I need a paid certificate?
For most sites no: free certificates from Let's Encrypt are just as secure as paid ones. Paid certificates mainly offer extra guarantees or organization validation, not more encryption.
What are CT logs?
Public logs recording every issued certificate. Handy to see whether someone requested a certificate for your domain that you don't know about.
My padlock is gone. What now?
Usually the certificate has expired or is for the wrong name, or your page loads something over http. Check the expiry date, the name on the certificate, and whether all parts load over https.