SSL certificate
TLS certificate / HTTPS / the padlock / not secure warning
An SSL or TLS certificate is the file that lets a browser confirm it is really connected to your domain, and it turns on encryption for the connection. It binds your keys to your domain name. It says nothing about whether the business behind the domain is trustworthy, and it is usually free.
The specification is unusually readable on what this is for. TLS provides three things: authentication, where the server side of the channel is always authenticated and the client side only optionally; confidentiality, where data sent after the connection is established is only visible to the endpoints; and integrity, where data cannot be modified by attackers without detection. Notice which way the authentication runs. The site proves itself to the visitor. The visitor usually proves nothing.
The certificate is the part that does that proving. Mozilla describes it as containing a digitally signed copy of the public key that matches the website's private key, and says what the point of that is: it binds the website's keys to their domain name, so the browser knows it really is connecting to the address in the bar rather than somewhere else wearing the same name.
Read that binding carefully, because it is narrower than people assume. What is being vouched for is a domain name. Not the company behind it, not what it sells, not what it does with what you type in. A padlock means the connection goes where the address says and cannot be read on the way. It is not a character reference.
The specification is honest about a limit too, which is rare enough to be worth quoting. TLS does not hide the length of the data it transmits. Encryption in transit is a strong and narrow guarantee, and it stops at the point the data arrives.
In practice
The line item is worth checking. Mozilla notes that Let's Encrypt is a widely used nonprofit certification authority issuing free TLS certificates, and that modern web hosting services support HTTPS for you. So an annual charge for an SSL certificate is not automatically wrong, since some certificates do cost money, but it is a fair question why this one does when the common path is free and included.
Not the same as
- A signal that a business is legitimate
- The certificate vouches for a domain name. Anyone who controls a domain can obtain one for it.
- Your site being secure
- This protects a connection in transit. It says nothing about the software, the passwords, or what happens to data after it arrives.
Why it matters to you
Visitors read the browser warning as a verdict on you, which makes a lapsed certificate a trust problem long before it is a technical one. The reverse error costs money instead: treating the padlock as proof that the business on the other end is sound, or paying yearly for something a host already includes. Knowing that it certifies a name and encrypts a pipe puts both errors to bed.
What to ask or check
- 01Which hostnames does our certificate actually cover?
- 02Who is responsible for renewing it, and what happens on the day it lapses?
- 03Is this a separate charge for something our hosting already provides?
What people get wrong
That the padlock says the business is trustworthy. It says the connection reaches the domain in the address bar and cannot be read in transit, which is a statement about a name rather than about a company.
Red flags
- An annual SSL charge alongside hosting that already supports HTTPS.
- A browser security warning treated as cosmetic rather than fixed.
- Nobody able to say who renews the certificate or when it next expires.
Who owns it
Usually the host or whoever controls the server. Worth naming a person, because the failure mode is a renewal nobody owned.
Where you will see it
Behind the padlock in the address bar, in hosting invoices, and in the browser warning that appears when it lapses.