SSL Certificate: What It Is, Types, and How It Works

An SSL certificate is a data file installed on a web server that binds a public key to a domain name and lets browsers connect over HTTPS. SSL stands for Secure Sockets Layer. The certificate does two jobs: it proves that the server answering for a domain is authorised to do so, and it supplies the key material used to encrypt everything sent between browser and server.

What an SSL Certificate Contains

A certificate is a signed record in X.509 format. Open the padlock in any browser and the same fields appear:

Subject: the domain name or names the certificate covers, listed in the Subject Alternative Name extension.
Public key: the key browsers use to negotiate an encrypted session. The matching private key never leaves the server.
Issuer: the Certificate Authority (CA) that signed it, such as Let’s Encrypt, DigiCert, or Sectigo.
Validity period: the not-before and not-after dates. Certificates issued after 15 March 2026 max out at 200 days, a CA/Browser Forum limit dropping to 47 days by 2029.
CA digital signature: the cryptographic proof that the CA vouches for the contents.

Browsers ship with a root store of trusted CAs. A certificate is trusted only if its signature chains back to a root in that store.

How SSL Works

Encryption starts with a handshake that runs before any page data moves. The steps below describe TLS 1.3.

The browser sends a ClientHello listing supported cipher suites and a key share.
The server replies with its certificate, its own key share, and a signature proving it holds the matching private key.
The browser validates the certificate: correct domain, unexpired dates, trusted issuer, not revoked.
Both sides derive the same symmetric session key from their key shares. The key is never transmitted.
All further traffic (URLs, form fields, cookies, headers) is encrypted.

TLS 1.3 completes this in one round trip. The asymmetric keys authenticate; the symmetric session key does the encryption, because it is far faster.

SSL vs TLS

TLS replaced SSL. Every certificate sold as an “SSL certificate” today is used with TLS, and the two names refer to the same file.

Version	Released	Status
SSL 2.0	1995	Prohibited by RFC 6176 (2011)
SSL 3.0	1996	Prohibited by RFC 7568 (2015), broken by POODLE
TLS 1.0	1999	Deprecated by RFC 8996 (2021)
TLS 1.1	2006	Deprecated by RFC 8996 (2021)
TLS 1.2	2008	Supported, still widely used
TLS 1.3	2018	Current standard (RFC 8446)

No version of SSL has been safe for over a decade. The name survived because it is what people search for. Chrome, Firefox, Safari, and Edge all dropped TLS 1.0 and 1.1 in 2020.

Types of SSL Certificates

Certificates differ on two axes: how much the CA verified, and how many hostnames are covered.

By validation level:

Domain Validation (DV): the CA checks only that the applicant controls the domain, usually via a DNS record or a file on the server. Issued in minutes, often free. Adequate for most sites.
Organisation Validation (OV): the CA also verifies the legal entity behind the domain against business records. Takes days.
Extended Validation (EV): the deepest vetting, covering legal, physical, and operational existence. Browsers dropped the green company name from the address bar in 2019, removing most of the practical advantage.

By coverage:

Single domain: covers one hostname, such as example.com plus its www variant.
Wildcard: covers all first-level subdomains under one name, written *.example.com. Covers go.example.com but not a.b.example.com.
Multi-domain (SAN or UCC): covers a list of unrelated hostnames in one certificate.

Encryption strength is identical across all of them. Price buys identity checks and warranty cover, not stronger security.

Why SSL Certificates Matter

Google confirmed HTTPS as a ranking signal in August 2014. It is a lightweight one, but the browser behaviour built on top of it is not. Chrome has labelled every HTTP page “Not secure” in the address bar since version 68 in July 2018.

There is also a measurement cost. Browsers strip the Referer header when a visitor moves from an HTTPS page to an HTTP one. Traffic that should appear as referral lands in direct instead, distorting channel reporting for any campaign passing through an insecure hop.

SSL Certificates for a Custom Domain

Any branded domain pointed at a hosted platform needs a certificate for that exact hostname. The platform issues it, not your web host, since the platform terminates the connection.

Add the CNAME record the platform gives you, confirm the domain inside the platform, and wait for provisioning. Most platforms use the ACME protocol with Let’s Encrypt, which validates domain control automatically and renews on a schedule with no manual step. Provisioning usually finishes within minutes of DNS propagating, though a CAA record on the domain that omits the issuing CA will block it silently.

Common SSL Certificate Errors

ERR_CERT_COMMON_NAME_INVALID: the hostname requested is not listed on the certificate. Common when a wildcard is asked to cover a second-level subdomain.
ERR_CERT_DATE_INVALID: the certificate expired, or the server clock is wrong.
ERR_CERT_AUTHORITY_INVALID: the chain does not reach a trusted root, usually because the server omits an intermediate certificate.
Mixed content: the page loads over HTTPS but pulls scripts or images over HTTP. The padlock disappears and browsers block active content.

Check any of these with the padlock icon, with openssl s_client -connect example.com:443 -servername example.com, or with the Qualys SSL Server Test, which grades the whole configuration.

Frequently Asked Questions

What is an SSL certificate?

An SSL certificate is a file on a web server that ties a public key to a domain name and is signed by a Certificate Authority the browser already trusts. It allows the site to serve pages over HTTPS. Without one, browsers cannot establish an encrypted session and will label the site “Not secure”.

Does an SSL certificate mean a website is safe?

No. A Domain Validation certificate proves only that someone controls the domain, not that they are trustworthy. Anti-Phishing Working Group data has shown most phishing sites running on HTTPS, since free certificates are trivial to obtain. The padlock means the connection is encrypted, not that the destination is legitimate.

How much does an SSL certificate cost?

Nothing, for most cases. Let’s Encrypt issues free DV certificates through the ACME protocol and is used by hundreds of millions of sites. Paid certificates start around $10 a year and run into the hundreds for OV and EV, where the cost buys identity verification and a warranty rather than better encryption.

What happens when an SSL certificate expires?

Browsers show a full-page interstitial and refuse to load the site until the visitor clicks through. Traffic, conversions, and API integrations break immediately. Automated renewal is the fix, since lifetimes are shrinking and a 200-day manual cycle is easy to forget.

Point a branded domain at your links with linkutm’s branded domains and the SSL certificate is issued and renewed for you.