What is an SSL certificate?

What it does

• It proves the site is the one in the address bar. The certificate names your domain, and the browser checks that name before it shows the page.
• It seals what travels between the visitor and your site. Contact forms, log-ins and card numbers can't be read or changed on the way, even on coffee-shop Wi-Fi.
• It gives you https. The "s" means the connection is sealed. Without a certificate, the address is plain http and browsers say "Not secure".

Most browsers show a padlock next to the address. Chrome now shows a small settings icon there instead; click it and "Connection is secure" means the certificate is working.

SSL or TLS: what's the difference?

None that you need to worry about. SSL is the old name: it was replaced in the late 1990s by TLS (Transport Layer Security), and every website uses TLS today. But the old name stuck, so web hosts, builders and help pages still say "SSL certificate".

These all mean the same thing: SSL certificate, TLS certificate, SSL/TLS certificate, security certificate, https certificate.

Do I need one?

Yes, even if you don't sell anything and have no log-in. Without one:

• Browsers warn people off. They put "Not secure" next to your address. See Why your site says "Not secure".
• Some browsers stop and ask first. Google has announced that Chrome will ask people's permission before opening a public site without https, as a setting that's on unless they turn it off.
• Anything typed can be read on the way. A contact form sends names, emails and messages in the open.

Who gives you one, and do I have to pay?

Certificates come from certificate issuers (certificate authorities): organizations that browsers have agreed to trust. You rarely deal with one yourself.

• On a website builder (Squarespace, Wix, Shopify and the like): it's included and free, once your domain points at the builder. See "Not secure" on Squarespace, Shopify, Wix or GoDaddy.
• With a web host: most include a free certificate from Let's Encrypt, a nonprofit issuer, and renew it for you. You may need to switch it on once in the hosting control panel.
• Paid certificates also check the business or organization behind the site, not only the domain. Browsers show the same padlock for free and paid ones, so for a shop, club or town site, free is enough.

If someone offers to sell you a certificate for a site on a builder that already has the padlock, you don't need it.

How long does an SSL certificate last?

Not long, and it's getting shorter. The CA/Browser Forum (where certificate issuers and browser makers agree the rules) voted in April 2025 to cut the longest a certificate may last:

Free certificates are shorter still. Let's Encrypt's last 90 days today, and it plans 64 days from February 2027 and 45 days from February 2028.

So the date on your certificate matters less than one question: does it renew by itself? Builders and most hosts do it for you. If yours doesn't, ask them to set it up, because nobody can renew by hand every few weeks. How to check when your domain expires shows where to find the date.

What happens when it expires?

• Visitors see a full-page warning, "Your connection is not private", before your site. Most leave. See "Your connection is not private".
• Forms, shops and log-ins stop for anyone who doesn't click past the warning.
• Your site is still there. Nothing is deleted, and once the certificate is renewed, the warning goes. Renewing is usually free and quick.

An expired certificate nearly always means automatic renewal broke, often because the domain moved or a setting changed. Ask your web host to renew it and to find out why it didn't renew itself.

How to check yours

1. Run Site health. It shows the date your certificate ends and who issued it, and warns you once it's within 14 days.
2. Let Site Watch keep an eye on it. It checks your site every night and emails you only when something changes, including a certificate within 14 days of running out or broken.
3. In your browser: click the padlock (or the settings icon) to the left of your address, then the line about the connection, to see whether it's secure.