What is an SSL certificate?
By Ash, Founder, HosteazePublished 2 min read
The short answer
An SSL certificate is a small data file, issued by a trusted certificate authority, that proves a website belongs to the domain it claims and lets browsers encrypt the connection. It's what turns http:// into https:// and stops browsers warning visitors that your site is not secure. Every website needs one, and basic ones are free.
Think of an SSL certificate as your website's passport. A trusted authority checks you control the domain, stamps the certificate, and every browser that visits can inspect it. If the details match, the browser sets up an encrypted connection and shows the address as https://. If they don't, visitors get a full-page warning, which is a quick way to lose an enquiry.
What does an SSL certificate actually do?
Two jobs. First, it proves identity: the certificate says "this is yourbusiness.co.uk", signed by a certificate authority (CA) the browser already trusts. Second, it carries a public key that lets the browser and server agree an encryption key, so passwords, card details and contact form messages can't be read on the way.
Without one, browsers label your site Not secure. Google also announced that Chrome would turn on its "Always Use Secure Connections" setting by default with Chrome 154 in October 2026, which means a warning before visitors reach any public site without HTTPS. If your site says not secure, this is the fix.
What types of SSL certificate are there?
| Type | What the CA checks | Typical cost | Good for |
|---|---|---|---|
| Domain Validated (DV) | That you control the domain | Often free | Almost every small business site |
| Organisation Validated (OV) | The domain plus your company's details | Paid | Firms that want company details in the certificate |
| Extended Validation (EV) | A stricter check of the organisation | Paid, the most expensive | Large organisations with specific compliance needs |
Browsers stopped showing company names in the address bar for EV certificates back in 2019, so visitors see the same thing whichever type you buy. For a typical small business, a free DV certificate gives exactly the same encryption as a paid one. Our comparison of free SSL vs paid SSL covers the rare cases where paying makes sense.
How do I get one?
Most hosts issue and renew a free certificate for you, usually from Let's Encrypt. Free SSL is included with Hosteaze hosting, so there's nothing to buy. If yours doesn't, our guide on how to install an SSL certificate walks through it.
Renewal is the part that catches people out. Certificate lifetimes are shrinking: under the CA/Browser Forum rules, certificates issued since 15 March 2026 can last at most 200 days. Let's Encrypt's last 90 days and are due to drop to 45 days by 2028. Manual renewal stopped being realistic a while ago, so make sure yours renews automatically.
More plain-English guides are in Email and domains.
Frequently asked questions
Is SSL the same as TLS?
Near enough. SSL was the original protocol and has been retired for years; modern sites actually use TLS. The old name stuck, so hosts and browsers still say SSL certificate when they mean a TLS certificate.
How long does an SSL certificate last?
As of October 2026, a public certificate can be valid for at most 200 days, falling to 100 days in March 2027 and 47 days in March 2029. Free certificates from Let's Encrypt last 90 days. Your host should renew them automatically.
Does an SSL certificate stop my site being hacked?
No. It protects data travelling between the visitor and your server. It does nothing about weak passwords, outdated plugins or a vulnerable contact form, so you still need the usual security basics.