SSL

SSL, or Secure Sockets Layer, is the name of a technology originally developed to secure communication between a user’s browser and a server. SSL is now obsolete and has been replaced by TLS (Transport Layer Security), although the terms “SSL” and “SSL certificate” remain widely used.

In practice, an SSL certificate now refers to an SSL/TLS certificate that allows a website to use a secure HTTPS connection. This connection protects data in transit, makes interception more difficult, and allows a browser to verify that it is communicating with the correct domain name.

What is an SSL certificate?

An SSL/TLS certificate is a digital document assigned to one or more domain names. It contains a public key, the domain names covered by the certificate, information about its issuer, and its validity period.

The certificate works with a private key stored on the server. This private key must not be publicly exposed. If it is compromised, an unauthorized party may be able to impersonate the server, so the certificate should be revoked and replaced.

Certificates used by public websites are usually issued by a Certificate Authority, or CA. Browsers and operating systems maintain stores of trusted certificate authorities that allow them to evaluate the certificate presented by a server.

How does an SSL/TLS certificate work?

When a user visits a website over HTTPS, the browser and server perform a process known as the TLS handshake. During this process:

• the server presents its certificate and the required certificate chain;
• the browser checks whether the certificate was issued by a trusted authority;
• it verifies that the certificate covers the requested domain and has not expired;
• the browser and server agree on the parameters of the secure connection;
• session keys are established to encrypt subsequent communication.

Once the handshake has been completed successfully, requests sent by the browser and responses returned by the server are transmitted in encrypted form.

What does SSL/TLS protect?

A TLS connection provides three essential forms of protection:

• confidentiality – data is encrypted in transit so that unauthorized parties should not be able to read it;
• integrity – unauthorized changes to transmitted information can be detected;
• server authentication – the browser can verify that the certificate was issued for the domain being visited.

This protection applies to information such as form submissions, login credentials, order details, server responses, and cookies transmitted over the secure connection.

What is the difference between SSL, TLS, and HTTPS?

These terms are related, but they do not describe exactly the same thing:

• SSL is an older communication security protocol that should no longer be used;
• TLS is the modern successor to SSL and secures the connection;
• an SSL/TLS certificate helps authenticate the server and participates in establishing secure communication;
• HTTPS is HTTP delivered through a secure TLS connection.

The term “SSL certificate” remains common in everyday language, hosting plans, and administrative dashboards. From a technical perspective, “TLS certificate” or “SSL/TLS certificate” is more accurate.

What are the different types of SSL certificates?

Certificates can be categorized by how the applicant is validated:

• DV (Domain Validation) confirms control of the domain name;
• OV (Organization Validation) also involves verification of the organization’s details;
• EV (Extended Validation) requires a more extensive review of the entity requesting the certificate.

A DV certificate confirms control of a domain, but it does not prove that the website belongs to an honest or trustworthy business. A fraudulent website can also obtain a certificate for a domain controlled by its operator.

Certificates can also differ according to the names they cover:

• a single-domain certificate covers a specific domain name;
• a multi-domain certificate can contain several domains or subdomains;
• a wildcard certificate covers subdomains at a particular level, such as *.example.com.

A wildcard certificate for *.example.com does not automatically cover the root domain example.com. That name must be added separately. Similarly, example.com and www.example.com are different hostnames and should both be included if both are used.

Is a free SSL certificate less secure than a paid one?

The price of a certificate does not directly determine the strength of the encryption. A trusted free DV certificate can provide a TLS connection that is just as secure as one using a paid certificate when the server is configured correctly.

Differences may involve the type of validation, certificate management, technical support, and additional services. Free certificates, including those issued by Let’s Encrypt, are widely used by business websites, online stores, and web applications.

What does an SSL certificate not protect?

HTTPS protects data while it travels between the user and the server, but it does not automatically secure the entire website. An SSL/TLS certificate does not protect against:

• vulnerabilities in a CMS, theme, plugin, or application;
• malware placed on the server;
• a compromised administrator account;
• attacks that exploit weak passwords;
• code defects and server configuration errors;
• leaks involving data stored in a database;
• fraud committed by the website’s operator.

HTTPS indicates that the connection to a particular domain is protected. It does not guarantee that the website itself is free from security threats or that its content and offers are trustworthy.

How do you install an SSL certificate on a website?

Implementation requires a certificate to be issued for the correct domain names, installed on the server, and configured for HTTPS. All HTTP addresses should then redirect permanently to their corresponding HTTPS versions.

Internal links, resources, canonical URLs, the XML sitemap, and third-party service settings should also be updated. Images, scripts, CSS files, and fonts must be loaded over HTTPS as well. Loading resources over unsecured HTTP creates mixed content, which browsers may block.

Once the migration is complete, the website may implement HSTS, a response header that instructs browsers to use HTTPS exclusively. HSTS should only be enabled after confirming that the entire website and all required subdomains work correctly over secure connections.

Why can an SSL certificate stop working?

Certificates have limited validity periods and must be renewed. Many hosting services automate this process, but certificate renewal should still be monitored.

A browser may display a security warning if the certificate has expired, does not cover the requested domain, was issued by an untrusted authority, is presented without the correct certificate chain, or is used with an unsupported security configuration.

The HTTPS configuration should be tested regularly, particularly after changing the hosting provider, domain name, server configuration, or certificate provider.