What is an SSL certificate
An SSL certificate encrypts the connection between your site and a visitor. Thanks to it the site opens on a secure https address and the browser shows a padlock.
Without SSL, data such as form input travels unencrypted. The browser warns that such a site is not secure.
An SSL certificate can be obtained for free today and is configured when the site launches.
Why SSL matters
Without SSL the browser shows a warning that instantly scares visitors away. Https is also a Google ranking factor. SSL is the mandatory minimum today.
What the certificate actually does
A certificate has two jobs. First, it confirms that the browser is talking to the server of this domain and not to someone in between. Second, the browser and the server use it to agree on a key that encrypts everything sent afterwards. On public WiFi nobody nearby can read what a visitor types into a form.
The name SSL has stuck out of habit. Technically its successor, TLS, is what runs today, but people mean the same thing.
Free versus paid certificates
Most websites are fine with a free Let's Encrypt certificate that the hosting installs and renews automatically. It is valid for only a few months and renewal happens in the background. The encryption is as strong as with a paid certificate.
A paid certificate differs in that the issuer verifies company details as well as the domain. Large clients or tender rules sometimes ask for one, but it gives an ordinary website or store no advantage.
Example: an online store and bank links
In an Estonian online store the buyer picks a bank through Montonio or Maksekeskus and the payment itself happens on the bank's secure page. Before that, though, the buyer types a name, address and phone number into the store and chooses a parcel locker. That data must travel encrypted too, so https has to cover the whole store, not just the checkout.
Common problems and how to check for them
Having a certificate does not guarantee everything is in order. Open your site with http:// and no s, and see whether you are sent to the https address automatically.
- Expired certificate: automatic renewal broke and the browser shows a full-screen warning.
- Mixed content: the page is on https but an image or script still loads from an old http address and the browser blocks it.
- Missing redirect: the site opens on both http and https, and Google sees two versions.
- The certificate does not cover the www or the non-www variant.
Frequently asked questions
Is an SSL certificate free?
Yes, a Let's Encrypt certificate is free and most hosting providers install it automatically. A paid one is needed when a partner or a tender requires a certificate with verified company details.
What is the difference between SSL and TLS?
TLS is the newer, more secure successor to SSL. The old SSL protocol is no longer used, but the name remains. When a host offers an SSL certificate, it actually works over TLS.
Does https make a website secure?
Https protects data on its way between the browser and the server. It does not protect against an outdated CMS, weak passwords or malware. Security also needs regular updates and backups.