SSL certificates and HTTPS explained

An SSL certificate — more accurately a TLS certificate today, though the older name has stuck, and the pairing is often written SSL/TLS or simply SSL TLS — encrypts the connection between a visitor’s browser and your server. It is what turns “http” into “https” in the address bar. SSL is the name almost everyone still searches; TLS is the protocol actually running underneath it, and both SSL and TLS are used interchangeably throughout this page for exactly that reason. Twenty searches a month in Australia ask what it actually is, measured 3 August 2026 in research/outer-volume-au.json, a modest but genuinely commercial number given how routine the feature has become.

What an SSL/TLS certificate actually certifies, and what it does not

The padlock icon confirms two specific things. First, that the connection between browser and server is encrypted, so data passing between them cannot be read in transit. Second, that a certificate authority has verified the domain is controlled by whoever requested the certificate. It does not certify that the business behind the site is legitimate, trustworthy, or who it claims to be in any broader sense. A scam site can have a perfectly valid, correctly issued SSL certificate. The certificate is about the connection to a domain. It is not about the character of whoever operates it. Treating the padlock as a general trust signal for a business is a common, understandable misreading of what it actually does.

Why “do you have SSL” is close to a meaningless question now

For most of the web’s history, certificates were a paid product, purchased separately and configured manually. That made “do you have SSL” a genuinely useful question about a hosting plan. Free, automated certificate issuance changed that. This happened most significantly through the nonprofit Let’s Encrypt initiative. The overwhelming majority of hosting providers, and every hosted platform covered in platforms, now issue and renew a basic domain-validated SSL certificate automatically. It comes at no separate cost, as a baseline inclusion rather than a premium feature. Asking whether a host or platform includes SSL is now closer to asking whether it includes electricity.

Where a paid SSL certificate still exists, and why

Extended Validation and Organisation Validation certificates still exist as paid products. They involve a more thorough check of the business behind the domain, and historically displayed additional visual trust indicators in the browser. Most current browsers no longer surface those indicators as prominently as they once did. That has significantly reduced the practical case for paying for a higher validation tier purely for its visible effect. What remains is closer to due-diligence signalling for specific industries than a meaningful visitor-facing difference.

How the TLS handshake, public key, private key and certificate authority secure a connection, in plain terms

None of this needs to be understood to run a website. But the mechanics explain why the padlock is trustworthy at all. Every SSL/TLS certificate contains a public key. It is tied to a matching private key that only the server holds. The certificate authority’s signature vouches that the public key genuinely belongs to that domain.

When a browser connects, the two sides perform a brief TLS handshake. The server presents its certificate. The browser verifies the certificate authority’s signature. The two sides then use the public and private key pair to agree on a temporary, symmetric session key. That session key is a single shared secret. It is far faster to encrypt and decrypt with than the public/private key pair itself. From that point on, the actual encrypted traffic between browser and server travels under that session key, not under the public key directly. That is why the connection stays fast, even though it started with a more expensive cryptographic exchange.

A server misconfiguration anywhere in that chain can produce the browser warnings covered above. An expired certificate, a leaked private key, or a handshake that fails to complete are the usual causes.

What actually still matters, once the certificate itself is free

Three things are worth confirming rather than assuming. First, that the certificate is genuinely renewing automatically. Most modern setups handle this without intervention. But a manually configured older server can silently let one lapse. That produces a visible browser warning that will turn away a real share of visitors on sight. Second, that the whole site actually redirects to the secure version, and does not serve a mixed version with some resources loaded insecurely. That triggers its own set of browser warnings, even with a valid certificate present. Third, whether the certificate covers every subdomain in use. A certificate for the bare domain does not automatically cover a separate subdomain, unless it was specifically issued to.

Why this is a baseline requirement, not an enhancement

Beyond the direct security benefit, HTTPS is now effectively mandatory for reasons unrelated to encryption itself. Browsers actively flag non-HTTPS sites as “not secure” in the address bar, which measurably affects visitor confidence. It has also been a stated ranking signal for search visibility for a considerable time. A site without HTTPS today is not offering a lesser version of the same experience — it is visibly flagged as deficient before a visitor reads a word of content.

A quick way to check a certificate yourself

Clicking the padlock icon in any modern browser reveals the certificate’s issuer and expiry date directly, without needing any technical tool. It is a genuinely useful, thirty-second check worth doing periodically on a business’s own site, rather than assumed to be someone else’s problem.

Mixed content warnings, briefly

A common, specific certificate-adjacent problem is a page that loads correctly over HTTPS but references one or two resources — an old image link, an embedded script — still pointing at an insecure HTTP address. That triggers a browser warning even though the certificate itself is entirely valid. This is usually a leftover from an earlier, non-secure version of the site and is worth checking for directly rather than assumed away once a certificate is confirmed present.

Wildcard SSL certificates, briefly

A wildcard certificate covers a domain and every subdomain of it in one issuance. That is a genuine convenience for a business running several subdomains. It is worth asking about specifically where more than one is in active use, rather than issuing and tracking several separate certificates.

One remaining nuance worth naming

None of the above changes when a subdomain is added later. A new subdomain generally needs its own certificate coverage confirmed at the time it is created, not assumed to inherit the main domain’s certificate automatically.

Common questions about SSL certificates

Do I need an SSL certificate? Yes — every business website should serve over https, and on virtually every current host and platform an SSL/TLS certificate is now issued and renewed automatically, at no separate cost. Asking whether a host “includes SSL” is now close to asking whether it includes electricity.

What does an SSL certificate actually prove? Two things: that the connection between browser and server is encrypted so data cannot be read in transit, and that a certificate authority verified the domain is controlled by whoever requested it. It does not certify that the business is legitimate — a scam site can have a perfectly valid certificate. The padlock is about the connection, not the character of whoever runs the site.

Where to go from here on your web server’s SSL/TLS setup

Whether a host or platform actually holds up its side of this is worth confirming directly when choosing a web host for a small business. The broader question of what generally makes a small-business site an easier or harder target is set out in why small-business websites get compromised. Any competent build should already be handling this as standard — see web development services.