What does "SSL certificate" mean?

An SSL certificate is technically a TLS certificate today: It assigns a public key to a domain and allows the browser to authenticate the web server when establishing an encrypted HTTPS connection. The term "SSL" is outdated; modern websites use TLS for transport encryption.

These terms serve different purposes: HTTPS refers to the secure HTTP connection, TLS is the security protocol, and the certificate is used for authentication. A certificate colloquially referred to as an HTTPS certificate does not encrypt the connection on its own. Only the interplay of TLS, the certificate, and a secure server configuration protects the transmitted data.

An SSL certificate confirms which domain a public key may be used for. TLS uses this information to authenticate the server and establish an encrypted HTTPS connection.

What is an SSL certificate?

An SSL certificate is a digitally signed file that associates a public key with a domain and, optionally, with a verified organization. Publicly trusted certificates are issued by a Certificate Authority (CA).

The key pair also includes a private key . The private key remains protected on the server and must not be published or shared without authorization. If the private key is compromised, the operator must replace the affected SSL certificate and, if necessary, have it revoked.

Although SSL encryption is still frequently mentioned, SSL 2.0 and SSL 3.0 are technically obsolete. The IETF also prohibits the negotiation of TLS 1.0 and TLS 1.1 in RFC 9325. Secure implementations must support at least TLS 1.2 and should prefer TLS 1.3.

How does an SSL certificate work with HTTPS?

When establishing an HTTPS connection, the browser checks the SSL certificate and negotiates cryptographic session keys with the web server. For you as the website operator, it is crucial that the domain, validity period, certificate chain, and server configuration are compatible.

1. The browser accesses the HTTPS address. The web server transmits its server certificate and the required intermediate certificates.
2. The browser checks the domain. The requested domain name must be included in the SSL certificate.
3. The browser checks the expiration date. The certificate must be valid at the time of the request.
4. The browser checks the certificate chain. The server certificate must be traceable back to a trusted root certificate via one or more intermediate certificates.
5. Browsers and servers establish session keys. TLS authenticates the server using the certificate and protects further data transmission with symmetric encryption.
6. The website is loaded via HTTPS. Transmitted content and form data are protected against easy reading and unnoticed changes during transport.

Transport encryption protects the transmission path between the browser and the server. However, an SSL certificate says nothing about how securely data is stored, processed, or transferred to other systems on the server.

The certificate chain of an SSL certificate

Browsers do not typically trust a server certificate in isolation. Trust is established through a certificate chain consisting of three levels:

• Server certificate: The specific SSL certificate for your domain or for multiple registered domains.
• Interim certificate: A certificate signed by a higher-level certification authority, which the CA uses to issue server certificates.
• Root certificate: The primary trust anchor, which is stored in the operating system or browser.

The web server must correctly deliver the required intermediate certificates in addition to the server certificate. If an intermediate certificate is missing, browsers or devices may display a certificate warning, even though the server certificate itself is valid.

Validation types for SSL certificates

Domain Validation (DV), Organization Validation (OV), and Extended Validation (EV) refer to different verification procedures used by the certification authority. The type of validation determines which information is checked before an SSL certificate is issued. It does not automatically determine the strength of the subsequent transport encryption.

• Domain Validation: During domain validation, the applicant proves that they control the domain in question. This proof can be provided, for example, via a DNS record or a technically provided audit file.
• Organization Validation: During Organization Validation, the CA also checks information about the organization, such as the company name and business address.
• Extended Validation: In Extended Validation, the CA verifies the legal identity of the operator according to more extensive standardized requirements.

A paid OV or EV certificate is not a general seal of quality for a website. A DV certificate can support the same modern TLS protocols and encryption methods as an OV or EV certificate. The difference lies in the scope of identity verification.

Duration and automatic renewal of an SSL certificate

Every SSL certificate has a fixed expiration date. After this date, browsers display a security warning or restrict access. Interfaces, forms, and connected services may also reject the connection.

Publicly trusted TLS server certificates must have limited validity. According to the CA/Browser Forum's Baseline Requirements, the maximum validity period for certificates issued between March 15, 2026, and March 14, 2027, is 200 days. From March 15, 2027, the limit decreases to 100 days, and from March 15, 2029, to 47 days.

Let's Encrypt issues certificates with a 90-day validity period by default and also offers certificates with a six-day validity period. Short validity periods limit the consequences of compromised keys and promote automated certificate management.

For a company website, automatic renewal should therefore be the norm. Additionally, the SSL certificate requires independent expiration monitoring. Automation is the execution of recurring tasks and rule-based processes by software, systems, or machines, ensuring that a process continues reliably without constant manual intervention. [ Click to learn more] This can fail, for example, after a hosting change, a modified DNS configuration, or due to insufficient access rights.

In my work with SMEs, the actual issue is rarely the issuing of the certificate. The critical problem lies in its ongoing operation: expiration dates aren't monitored, renewals fail, or after a relaunch, not all domain variations are correctly redirected to HTTPS. Therefore, in our web design and website development, we treat SSL certificate management as a recurring operational process.

Wildcard certificate and multiple domains

A wildcard certificate covers multiple subdomains of a domain. An SSL certificate for *.example.it can, for instance, be valid for shop.example.it and portal.example.it. The main domain, example.it, is not automatically included and must be added separately if necessary.

Alternatively, a server certificate can contain multiple specific domain names. This option is suitable, for example, for a primary domain, additional language domains, and selected subdomains. The appropriate solution depends on the system architecture, the number of domains, and the responsibilities for the private keys.

Typical warnings regarding an SSL certificate

A browser warning does not automatically prove an attack. However, the warning means that the browser cannot reliably confirm the identity or validity of the web server. You should therefore not ignore such a message.

• The SSL certificate has expired: Automatic renewal failed or the new certificate was not activated.
• The domain name is incorrect: The requested domain is not included in the certificate.
• The certificate chain is incomplete: A required intermediate certificate is missing on the server.
• The certification authority is not trustworthy: The root certificate is not stored as a trust anchor in the browser or operating system.
• The certificate is not yet valid: The validity period starts later, or the device's system time is incorrect.
• The private key does not fit: After a faulty installation, the certificate and private key do not belong to the same key pair.

Server logs can also be helpful in case of technical problems. The article about server logs for SMEs explains what information web servers collect and how you can systematically narrow down errors.

How to correctly integrate an SSL certificate into a website

Installing the certificate is only the first step. The entire website should be consistently accessible via HTTPS and should not serve any parallel HTTP versions.

• Set up HTTP redirection: All HTTP requests should be permanently redirected to the corresponding HTTPS address. Paths and parameters must be preserved.
• Check domain variants: This applies to domains with and without "www" as well as to language and subdomains.
• Update internal references: Navigation, images, downloads, scripts and interfaces should point directly to HTTPS addresses.
• Eliminate mixed content: An HTTPS page should not load images, fonts, scripts, or stylesheets unencrypted over HTTP.
• Monitor renewal: Automated processes require error messages, responsible contacts, and a documented backup process.
• Test changes: Hosting changes, DNS changes, new subdomains and relaunches can affect a functioning certificate configuration.

For websites that have grown organically, an inventory of all domains, media, and technical dependencies is helpful. A website content inventory reveals outdated HTTP resources and overlooked domain variations before a relaunch.

What an SSL certificate cannot do

HTTPS is a necessary foundation for modern website security, but not a complete security concept. A valid SSL certificate does not prevent malware, weak passwords, outdated software, incorrect access rights, or security vulnerabilities in extensions and interfaces.

Transport encryption is only one technical safeguard for data protection . HTTPS does not automatically make a website compliant with data protection regulations. Other relevant factors include data minimization, legal bases, retention periods, external services, access controls, and the handling of personal data. The article on Privacy by Design for SMEs explains how data protection protects the personal data of natural persons from unlawful processing, misuse, and loss of control. Data protection for SMEs therefore means: You consciously decide which data you collect... Click to learn more

HTTPS protects data during transmission. Website security and data protection must also consider the application, the server, stored data, and organizational processes.

Checklist for your SSL certificate

• The server supports at least TLS 1.2 and preferably TLS 1.3.
• The SSL certificate is valid for all domains actually used.
• The server delivers the complete certificate chain.
• Automatic renewal is set up, tested, and monitored.
• HTTP requests are permanently redirected to HTTPS.
• Internal links, images, scripts, and font files do not cause mixed traffic. ContentContent encompasses all intentionally published digital content on websites, in online shops, on social media channels, in newsletters, and in other digital environments. If you want to know more... Click to learn more.
• Private keys are stored securely and replaced if compromised.
• Responsibilities for certificate warnings and outages are documented.

Questions and answers about the SSL certificate

How much does an SSL certificate cost?

A DV certificate can be issued free of charge via Let's Encrypt, for example. Costs may arise for hosting, setup, monitoring, and maintenance. Paid OV or EV certificates include additional identity verification but do not automatically offer stronger encryption.

How long is a TLS certificate valid?

The validity period depends on the certificate authority and the certificate type and is limited by industry regulations. Because the maximum permissible validity periods are decreasing, you should renew your SSL certificate automatically and also monitor its expiration date.

What happens when an SSL certificate expires?

Browsers may display a security warning and restrict access. Interfaces, payment services, and other automated systems may reject the connection until a valid certificate is installed.

Do I need a separate certificate for each subdomain?

Not necessarily. A wildcard certificate can cover multiple subdomains of the same domain. A certificate with multiple domain names, on the other hand, can group specific domains together. The appropriate solution depends on your technical infrastructure and who is authorized to access the private key.

Why does my website need an HTTP redirect?

HTTP redirection automatically directs unencrypted requests to the corresponding HTTPS address. This prevents parallel page versions and ensures that visitors access the secure version of the website.

What does mixed content mean?

Mixed content occurs when an HTTPS page still loads individual images, fonts, scripts, or other files via HTTP. Browsers may block such resources or display warnings. Therefore, all components of the page should be loaded via HTTPS.

Does the lock symbol mean that a website is trustworthy?

The symbol confirms a technically protected connection to the specified domain. It does not assess the provider's trustworthiness, the quality of the content, the application's security, or the website's compliance with data protection regulations.

Is an EV certificate more secure than a DV certificate?

An EV certificate includes more extensive identity verification of the operator. However, the encryption strength can be identical for DV, OV, and EV certificates if the same TLS protocols and cryptographic methods are used.

Is HTTPS sufficient for a secure and privacy-compliant website?

No. HTTPS primarily protects data transmission between the browser and the server. A secure and privacy-conscious website also requires well-maintained software, secure access, appropriate permissions, data minimization, and clear organizational processes.

Sources

1. IETF RFC 9325: Recommendations for Secure Use of TLS and DTLS — ietf.org (2022)
2. Baseline Requirements for Publicly-Trusted TLS Server Certificates — cabforum.org (2026)
3. Certificate Lifetime Rationale and Plans — letsencrypt.org (2026)
4. Information for the Public: Types of SSL Certificates — cabforum.org