Topic hub

SSL Certificates

An SSL/TLS certificate allows a browser to verify the hostname and establish an encrypted HTTPS connection. For a business owner, the critical controls are complete hostname coverage, automatic renewal, secure key…

1 published guides0 subtopicsUpdated 21 July 2026

Start here

The main guide for this topic

Step-by-step

How to Set Up an SSL Certificate

The safest small-business setup uses automated certificate issuance and renewal through the host, platform or an ACME client. Installation is complete only after every required hostname works, HTTP re…

Open the complete guide →

Published guides

Articles in this section

Step-by-step27 August 2026

How to Set Up an SSL Certificate

The safest small-business setup uses automated certificate issuance and renewal through the host, platform or an ACME client. Inst…

Read guide →

About this section

What a certificate proves

A certificate proves that the server is authorised to use the covered hostname and enables encrypted transport. It does not prove that the business is trustworthy, that the website is free from malware or that customer data is handled lawfully.

Certificate choices

Common certificate approaches
Choice	Use	Main consideration
Single-name certificate	One exact hostname	Other variants need separate coverage
Multi-domain certificate	Several named hostnames	Renewal affects all listed names
Wildcard certificate	Many first-level subdomains	Private-key exposure has a wider impact
Automated domain-validated certificate	Most ordinary websites	Renewal automation and validation access must work

Operate HTTPS as a system

Cover the canonical domain and required variants.
Redirect HTTP to HTTPS only after HTTPS works.
Use HTTPS in internal links, canonicals and sitemaps.
Monitor expiry and renewal failures.
Protect private keys and revoke compromised certificates.
Check forms, downloads, images and third-party resources for mixed content.

Cost is not the quality test

Let's Encrypt is a free, automated certificate authority. Paying for a certificate may include support or a different validation product, but an expensive certificate does not automatically provide stronger transport encryption for an ordinary site.

Where to start

Most small-business sites should use provider-managed automated issuance and renewal, then independently monitor HTTPS. Manual certificate installation without a tested renewal process creates avoidable outages.

Certificate inventory

List every public hostname, where TLS terminates, who issues the certificate, how validation works, how renewal is deployed and who receives failure alerts. This matters when a CDN fronts the site: the browser-facing certificate and the origin-server certificate may be separate.

Review abandoned staging, API and old campaign hostnames as well as the main website. An expired secondary hostname can still trigger warnings in links, integrations or customer bookmarks.

Final publication check

Every public hostname appears in the certificate inventory.
Renewal and deployment are automated and monitored.
Private-key access is restricted.
The canonical site, origin and CDN endpoints are understood.

Sources and date checked

Technical and policy information was checked on 21 July 2026. Recheck provider-specific procedures before making a live change.