What is SSL Certificate?
Definition
An SSL certificate (now technically a TLS certificate) is a digital file that proves a website's identity and enables an encrypted HTTPS connection, so data sent between a visitor's browser and the site cannot be read or altered in transit.
Last updated 2026-10-18 · Flowmatix
How an SSL certificate works
When someone opens your site, their browser and your server perform a quick exchange called a handshake. The server presents its certificate, which was issued by a trusted certificate authority (CA) after checking that you control the domain. The browser verifies the certificate is valid, unexpired and matches the address, then both sides agree on encryption keys for the session.
The result is the https:// in the address bar. Browsers flag sites that load without it, and visitors see warnings when a certificate has expired or does not match the domain.
There are three main validation levels: domain validation (DV), which confirms control of the domain and suits most small business sites; organisation validation (OV); and extended validation (EV), which involve checks on the business itself. All three provide the same encryption strength.
Certificate lifetimes are getting shorter. Under a CA/Browser Forum schedule, publicly trusted certificates issued from March 15, 2026 are limited to 200 days, falling to 100 days in March 2027 and 47 days in March 2029.
Why it matters for your business
Any site with a contact form, login or checkout handles personal information, and HTTPS protects it in transit. An expired certificate can block visitors with a full-page browser warning, which looks alarming and stops enquiries and sales instantly.
HTTPS is also a baseline expectation for search engines, payment providers and integrations. Payment processors and webhook senders such as Stripe require valid HTTPS endpoints.
Common mistakes
- Renewing certificates by hand and forgetting, especially as lifetimes shrink. Automate renewal.
- Mixed content: an HTTPS page loading images or scripts over plain HTTP.
- Covering
example.combut notwww.example.com, or missing subdomains. - Leaving HTTP versions of pages live instead of redirecting them to HTTPS with a 301 redirect.
- Assuming the padlock means the whole site is secure. It protects data in transit, not a vulnerable plugin or weak password.
Frequently asked questions
Do I need to pay for an SSL certificate?
Not always. Free certificate authorities and most modern hosts provide DV certificates with automatic renewal, which is enough for most business sites.
What is the difference between SSL and TLS?
TLS is the modern successor to SSL. The older name stuck, so "SSL certificate" is still common, but current connections use TLS.
Who should monitor my certificate?
Whoever maintains the site. Certificate expiry belongs on the same checklist as backups and updates; our guide to website maintenance covers what that routine should include.
How Flowmatix can help
Our website care work puts this into practice for businesses in Toronto and around the world. Get a personalised quote in about 3 minutes.
Related terms
Ready to see what your project costs?
Answer a few questions and get a personalised plan, a comparison with typical market prices, and a clear next step. No obligation, no sales pressure.