What is an SSL certificate, and what does the padlock mean?
An SSL certificate (strictly, a TLS certificate) is a file that lets a browser confirm it's talking to the real server for a domain and then encrypt everything in between. It proves control of the domain, not that the business behind it is honest. For most sites it should be free, automatic and renewed without anyone touching it.
What the certificate does
When a browser opens https://example.com, the server sends its certificate. The browser checks three things: the certificate names example.com, it hasn't expired, and it was signed by a certificate authority the browser trusts. If all three pass, the two sides agree keys and the connection is encrypted. Nobody on the network between them, such as a café's wifi or an internet provider, can read or quietly alter the page, the form a visitor fills in, or the reply.
SSL is the old name; the protocol in use today is TLS. People still say SSL certificate, and they mean the same thing.
What the padlock does not mean
- It doesn't mean the site is trustworthy. Anyone who controls a domain can get a certificate for it, including someone running a convincing fake shop.
- It doesn't mean the site is secure in other ways. A site can be served over HTTPS and still have weak passwords, outdated software or a form that emails data in plain text.
- It doesn't vouch for the business. Standard certificates are domain-validated: they prove control of the name, not who owns it.
How a certificate is issued
Let's Encrypt's explanation of how it works is a good model of modern issuance. Software on the host asks the certificate authority for a certificate; the authority sets a challenge, such as placing a file at a known address on the domain or adding a DNS record; it checks the challenge from several network locations; and if it passes, it issues a certificate for the host's public key. The certificate is also logged publicly in Certificate Transparency logs, so anyone can see what has been issued for a domain.
Certificate lifetimes are getting shorter. The CA/Browser Forum, which sets rules for publicly trusted certificates, agreed in Ballot SC-081 to reduce the maximum in stages from 398 days to 47 days, starting in March 2026 and finishing in March 2029. Manual renewal once a year is on its way out; automatic renewal is the only practical approach.
Fixing "Not secure" and certificate warnings
- Check the address. If it starts with
http://, the page isn't using HTTPS at all. Make sure the host has a certificate for that exact name, then redirect HTTP to HTTPS. - Click the warning and read it. "Certificate expired" means renewal failed. "Name mismatch" means the certificate covers a different name, often
wwwbut not the bare domain, or the other way round. - Check DNS for a brand-new domain. Hosts can't issue a certificate until the domain points to them. If you've just connected a domain, wait for DNS, then for issuance.
- Look for mixed content. A padlock with a warning, or missing images, often means the page loads something over
http://. MDN's mixed content guide explains that browsers upgrade some of it, like images, and block the rest, like scripts and stylesheets. Change everyhttp://URL in the page tohttps://. - Check old links in forms. A form whose
actionstarts withhttp://sends data unencrypted, and browsers warn about it.
Do you need to buy one?
For most websites, no. Free, automated domain-validated certificates provide the same encryption as paid ones. Paid certificates add organisation or extended validation, which checks the business behind the domain, but browsers no longer show that prominently, so few small sites benefit. Many hosts issue and renew certificates for you; if yours charges extra for basic HTTPS, that's worth questioning.
Mistakes to avoid
- Covering only one of
wwwand the bare domain when visitors use both. - Uploading a certificate by hand and forgetting the renewal date.
- Leaving
http://links to your own pages and images in old content. - A redirecting domain with no certificate, so visitors see a warning before the redirect.
Check it worked
Open the site in a private window on every form of the address you use, with and without www. Click the padlock and view the certificate: the name should match and the expiry should be in the future. Then search the page source for http://; there should be no results pointing at resources.
HTTPS on Anticode sites
Sites published to name.anticode.dev are served over HTTPS. When you connect your own domain on a paid plan, the certificate is issued automatically through Cloudflare for SaaS once your DNS record is found, and the status moves to Live; there's nothing to buy or install. Sentinel's checks include that every URL in the page uses HTTPS, and the server re-checks HTTPS at publish, so mixed content can't go live. Each hostname you connect gets its own certificate; a form of the name you haven't connected isn't covered. See connecting a custom domain and www vs non-www.
Questions people ask
Is SSL the same as TLS?
In everyday use, yes. TLS replaced SSL years ago, but the certificates are still widely called SSL certificates.
How long does a certificate last?
Maximum lifetimes are shrinking in stages towards 47 days by 2029. Automatic renewal makes the lifetime irrelevant to you.
Does HTTPS help search ranking?
Google prefers HTTPS pages over equivalent HTTP pages when choosing which version to show. Its bigger effect is that browsers warn visitors away from forms on HTTP pages.