What an SSL certificate is
An SSL certificate is a small data file installed on your web server. It does two jobs:
- Identity. It proves that the server answering for
yourbusiness.inis really authorised to use that name. - Encryption. It lets the browser and server agree on keys to encrypt everything they send each other, so nobody on the network (public Wi-Fi at a café, for example) can read or change it.
When both work, the browser shows https:// and a padlock or similar icon. When they do not, it shows "Not secure" or a full page warning.
SSL or TLS?
SSL (Secure Sockets Layer) was the original protocol from the 1990s. It was replaced by TLS (Transport Layer Security), and every SSL version is now considered insecure. Modern sites use TLS 1.2 or TLS 1.3. The name "SSL certificate" stuck, so you will see both terms used for the same thing.
How it works: the handshake, simplified
Understanding how an SSL certificate works comes down to one exchange, called the TLS handshake. It happens in a fraction of a second before any page content loads. This is simplified from TLS 1.3, defined in RFC 8446:
- Browser says hello. It sends the domain it wants, the encryption methods it supports and its half of a key exchange.
- Server replies. It picks an encryption method, sends its half of the key exchange, and sends its certificate.
- Browser checks the certificate. Is it issued for this exact domain? Is it within its validity dates? Was it signed by a certificate authority the browser trusts? Has it been revoked?
- Server proves it holds the private key. It signs part of the handshake with the private key that matches the certificate. Only the real server has that key.
- Both sides derive the same session keys. From the key exchange, both compute shared keys without ever sending them across the network.
- Encrypted traffic begins. The page, form submissions and cookies travel encrypted.
The key point: the certificate contains a public key that anyone can see. The matching private key never leaves your server. If someone copies your certificate, it is useless to them without the private key.
Who vouches for a certificate: certificate authorities
Anyone can create a certificate. Browsers trust only certificates signed by a certificate authority (CA) whose root is in the browser's or operating system's trust store.
The chain works like this:
Root CA certificate (pre-installed in browsers and operating systems)
└─ Intermediate CA (signed by the root, used for day to day issuing)
└─ Your certificate (signed by the intermediate, installed on your server)
Your server must send your certificate plus the intermediate. A missing intermediate is a common cause of certificates that work on a laptop but fail on some phones.
CAs must follow the Baseline Requirements published by the CA/Browser Forum, an industry body of CAs and browser makers. Those rules set how domains are validated and how long certificates may last.
DV, OV and EV: validation levels
The difference between certificate types is how much the CA checks before issuing. The encryption is the same.
| Type | What the CA checks | Typical issue time | Good for |
|---|---|---|---|
| Domain Validated (DV) | You control the domain (via a DNS record, a file on the site, or email) | Minutes | Most websites, blogs, small business sites, many shops |
| Organisation Validated (OV) | Domain control plus that the organisation legally exists | Days | Companies that want their name in the certificate details |
| Extended Validation (EV) | Stricter checks on the organisation's legal and operational existence | Days to weeks | Organisations with policy or compliance reasons |
Browsers used to show a green bar with the company name for EV certificates. Major browsers removed that display some years ago, so visitors see the same padlock for DV, OV and EV. The organisation details are only visible if someone opens the certificate viewer.
There are also wildcard certificates (cover *.yourbusiness.in, all first level subdomains) and multi domain or SAN certificates (cover several named domains). These are about coverage, not validation level.
Validity periods are getting shorter
Certificates expire so that keys are replaced regularly and validation is repeated. The CA/Browser Forum adopted Ballot SC-081v3 in April 2025, which reduces the maximum lifetime of publicly trusted TLS certificates in steps:
| Certificates issued | Maximum validity |
|---|---|
| Before 15 March 2026 | 398 days |
| From 15 March 2026 | 200 days |
| From 15 March 2027 | 100 days |
| From 15 March 2029 | 47 days |
The same ballot shortens how long a CA can reuse a domain validation check, eventually to 10 days by 2029.
What this means for you: buying a "multi year SSL" no longer means one certificate for several years. Any multi year product is a subscription under which the certificate is reissued repeatedly. Manual renewal every few months is easy to forget, and an expired certificate shows visitors a full page warning. Automatic issuance and renewal, usually through the ACME protocol, is now the practical approach for most sites.
Free vs paid certificates
| Free DV certificate | Paid certificate | |
|---|---|---|
| Encryption strength | Same | Same |
| Browser trust | Trusted by major browsers | Trusted by major browsers |
| Validation level | DV only | DV, OV or EV |
| Renewal | Usually automatic through the host | Automatic or manual, depending on the provider |
| Extras | None | Possible warranty, support, site seal |
Free CAs such as Let's Encrypt issue DV certificates and expect them to be renewed automatically. For most small business sites, blogs and many online shops, a free DV certificate is enough. Choose OV or EV if a client, regulator or tender document specifically asks for it.
ODHOST note: All five ODHOST shared hosting plans include a free SSL certificate. Which CA issues it and how renewal is scheduled can be confirmed in your control panel or with support. On cPanel, the SSL/TLS Status page shows which domains are covered.
Certificates can only be issued once your domain points at the server, because the CA checks control of the domain. If you are still setting that up, see how to connect a domain to hosting.
Mixed content: why the padlock disappears
A page loaded over HTTPS that pulls an image, script or stylesheet over plain http:// has mixed content. Browsers block insecure scripts and styles and may upgrade or flag images, and the padlock may change to a warning. MDN's mixed content page explains how browsers treat each case.
It usually happens after moving an old site to HTTPS, because links in the database or theme still use http://. Typical fixes:
- Update the site URL in your CMS settings to
https://. - Replace hard coded
http://links in content, themes and widgets. - Redirect all HTTP requests to HTTPS at the server.
A basic Apache redirect in .htaccess:
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
The help article on fixing "Not secure" and mixed content has step by step fixes for WordPress and plain sites.
Common certificate errors
| Browser message | Usual cause |
|---|---|
NET::ERR_CERT_COMMON_NAME_INVALID |
Certificate does not cover the name visited, for example www missing |
NET::ERR_CERT_DATE_INVALID |
Certificate expired, or the visitor's device clock is wrong |
NET::ERR_CERT_AUTHORITY_INVALID |
Self signed certificate or missing intermediate |
ERR_SSL_PROTOCOL_ERROR |
Server misconfiguration, or HTTPS not set up on that domain |
More fixes are collected in troubleshooting common hosting errors.
What SSL does not do
A certificate secures the connection, not the website. It will not stop a hacked plugin, a guessed password or malware already on the server. Treat it as one part of a wider plan, covered in how to secure a website.
Frequently asked questions
What is the full form of SSL?
SSL stands for Secure Sockets Layer. It has been replaced by TLS (Transport Layer Security), but the certificates are still commonly called SSL certificates.
Is a free SSL certificate as secure as a paid one?
For encryption, yes. A free DV (domain validated) certificate uses the same encryption as a paid one. Paid certificates may add organisation validation, warranties or support, but they do not encrypt more strongly.
How long is an SSL certificate valid?
Under the CA/Browser Forum rules, publicly trusted TLS certificates issued from 15 March 2026 can be valid for at most 200 days. The limit drops to 100 days from 15 March 2027 and 47 days from 15 March 2029.
Does an SSL certificate stop my site being hacked?
No. It protects data travelling between the browser and server. It does not protect against weak passwords, outdated plugins or malware on the server.
Why does my site show Not secure even though I have SSL?
Usually because the page loads some images, scripts or styles over http://, which is called mixed content, or because the certificate does not cover the exact domain name being visited.