An SSL certificate — more accurately a TLS certificate — is a digital credential used during an HTTPS connection. It helps the browser confirm the hostname and agree encrypted communication with the server.
What happens when a page loads
- The browser connects to the HTTPS service.
- The server presents a certificate and supporting chain.
- The browser checks the certificate authority, validity and hostname coverage.
- The browser and server establish encrypted session keys.
- The page is transferred over the encrypted connection.
What HTTPS protects
- Content from casual interception while travelling between browser and server.
- Form submissions and login credentials in transit.
- Integrity against many forms of network tampering.
- Confidence that the browser reached a server authorised for the hostname.
What it does not protect
- A compromised website application.
- Weak passwords or stolen administrator sessions.
- Dishonest business practices.
- Data copied from the server after arrival.
- Malware on the visitor’s own device.
Why certificate warnings happen
| Warning | Typical cause |
|---|---|
| Expired certificate | Renewal failed or was not installed |
| Name mismatch | Certificate does not cover the requested hostname |
| Untrusted issuer or chain | Incorrect server chain or unsupported certificate |
| Mixed content | HTTPS page loads some resources over HTTP |
Business requirement
Use HTTPS across the whole site, not only the checkout or contact form. Confirm automated renewal and monitor the live public hostname rather than relying solely on a control-panel status.
Why the name “SSL” remains common
Modern secure connections use TLS, but providers and users still say “SSL certificate”. The wording is usually harmless as long as the service uses current protocols and configurations. A business should focus on trusted certificates, supported TLS versions, complete hostname coverage and renewal rather than buying a product because it carries a more expensive badge.
The visible padlock or browser indicator confirms an encrypted connection to the hostname; it should never be used as the sole test that an unfamiliar website or payment request is legitimate.
Final publication check
- The certificate matches the requested hostname.
- The browser trusts the complete chain.
- HTTPS is not being presented as proof that the business itself is trustworthy.
- Application security and privacy controls are reviewed separately.
Sources and date checked
Technical and policy information was checked on 21 July 2026. Recheck provider-specific procedures before making a live change.
Keep the decision under your control
Retain the relevant accounts, source material, supplier terms and recovery information. Recheck changing prices, interfaces and rules before acting.