What is SSL?
Author: Domeny.ForSale editorial team Published
In brief: SSL is the common name for the technology that secures the connection between a browser and a website’s server. Modern websites use its successor, TLS, although the term “SSL certificate” is still widely used. This connection protects data in transit from being read or altered along the way, but does not guarantee that the website’s owner is trustworthy.
SSL, TLS and HTTPS — how do they differ?
SSL, or Secure Sockets Layer, is an older protocol for securing network communications. Its successor is TLS — Transport Layer Security. Older SSL versions are obsolete and should not be used; however, the name has persisted in hosting and certificate offerings.
HTTPS is HTTP, the protocol used to communicate with a website, secured by TLS. An address beginning with https:// therefore indicates an attempt to connect to the website using this protection. The browser checks the connection and may display a warning if there are problems.
A certificate is a digital document that binds a domain name to a public key used to authenticate the server. During a normal website visit, the browser checks, among other things, whether the certificate matches the address, is valid and comes from a trusted chain of issuers. The certificate itself does not encrypt the entire transmission — it is part of the mechanism that allows a connection to be established securely.
What does an encrypted connection protect, and what does it not protect?
TLS ensures the confidentiality of data in transit and its integrity, meaning protection against undetected changes during transmission. It also helps confirm that the browser is communicating with a server authorised to serve the specified domain.
For example, when a customer enters a password or delivery address in an online shop that uses HTTPS correctly, someone eavesdropping on network traffic should not be able to read that information. Without encryption, the contents of the form could be intercepted. HTTPS also protects the content of the page being transmitted from being replaced along the way.
However, an encrypted connection does not mean that the website itself is safe or trustworthy. A scammer can also obtain a certificate for their domain. Before making a payment, therefore, check the shop’s exact address and the seller’s details, rather than relying solely on the browser’s connection indicator.
TLS does not protect data once it has been stored on the server, remove viruses or fix application errors. It does not provide complete anonymity: a network observer may still be able to see some information about the connection, such as the server’s IP address. Software updates, access controls and backups remain separate tasks.
Which certificate should you choose for your website?
For a typical blog, business website or online shop, a DV certificate, which verifies control over the domain, is usually sufficient. The issuer checks whether the applicant can demonstrate that control, for example through an appropriate record in DNS — the system that directs domain traffic to the correct services.
OV and EV certificates also include verification of the organisation, with EV requiring more extensive checks under the issuer’s rules. This does not automatically mean stronger encryption than with DV. Choosing such a certificate may be driven by organisational or contractual requirements rather than a need to better secure the transmission itself.
When choosing a certificate, first check which names it covers:
example.comandwww.example.comare two different names; the certificate should cover both if both are to work over HTTPS.- A wildcard certificate for
*.example.comcovers subdomains one level deep, such assklep.example.com, but not the domainexample.comitself or the addresspanel.sklep.example.com. - A single certificate can cover several specified names if they have been included in it.
A free certificate from a trusted issuer can provide the same level of encryption as a paid one with a comparable configuration. The fee may cover additional verification, support or administration. Confirm current availability, terms and renewal procedures in the documentation provided by your hosting provider or certificate issuer.
How do you enable HTTPS on your website?
On shared hosting, a certificate can often be enabled in the administration panel. On your own server, you need to configure the web server and a renewal mechanism. If you use a CDN, a network that acts as an intermediary in delivering content, also secure the connection between the CDN and the origin server.
A practical implementation sequence is as follows:
- Identify all the domain names in use, including the
wwwversion and any required subdomains. - Have the certificate issued and install it, following your provider’s instructions.
- Check that the website works over HTTPS, especially logins, forms and payments.
- Change the website address in the content management system and references to images, scripts and stylesheets to HTTPS.
- Set up a permanent redirect from HTTP to HTTPS.
- Enable automatic renewal and notifications about problems.
Any remaining resources loaded over HTTP cause what is known as mixed content. The browser may block them or try to retrieve them over HTTPS, which can cause parts of the website to stop working. Installing the certificate alone therefore does not complete the implementation.
How do you check a certificate and respond to errors?
You can check the connection status and certificate details in the site information available next to the address bar. The appearance of this menu depends on the browser — not every browser displays a traditional padlock. Check the domain name and the certificate’s validity period.
A warning may indicate that the certificate has expired, does not match the address or that the server is configured incorrectly. An incorrect date on the device can also be the cause. As a visitor, do not bypass a warning to enter a password or payment details; as an administrator, resolve the cause rather than asking users to accept the error.
If you manage a website, start by checking in the hosting panel whether the certificate covers all the addresses in use and renews automatically. Then submit a test form over HTTPS — this is a simple way to check that the protection also works where users submit data.
See also: What is a CDN?
Read also
