Home / Blog / Security and Reliability / SSL Certificates and HTTPS Explained
Every modern website should load over HTTPS. Browsers warn visitors away from plain HTTP sites, search engines treat HTTPS as a ranking signal, and any page that handles logins, payments, or personal data needs encryption. Yet the terminology — SSL, TLS, DV, OV, EV, wildcard, SAN — confuses even experienced site owners.
This guide explains what actually happens when a browser connects over HTTPS, which certificate type fits which site, and how to avoid the renewal and configuration mistakes that take sites offline.
SSL (Secure Sockets Layer) is the original protocol from the 1990s. It has been replaced by TLS (Transport Layer Security), and the old SSL versions are insecure and should not be used. The industry still says “SSL certificate” out of habit, but what you are actually buying or installing is a TLS certificate. When a host or a guide says “SSL”, read it as “TLS” unless it specifically means an obsolete SSL version — in which case, walk away.
The TLS handshake, simplified:
If any check fails — expired certificate, wrong domain, untrusted issuer — the browser shows a warning and most visitors leave. Encryption also provides authentication (you are talking to the server named on the certificate, not an impostor) and integrity (the data cannot be altered in transit without detection).
Certificates differ mainly in how much the CA checks before issuing:
| Type | What is verified | Issuance time | Best for |
|---|---|---|---|
| DV — Domain Validation | Control of the domain only | Minutes | Most websites, blogs, small business sites, APIs |
| OV — Organization Validation | Domain control plus the organisation’s identity | 1–3 business days | Business sites where verified identity matters |
| EV — Extended Validation | Strictest checks on the legal entity | 1–2 weeks | Banks, large e-commerce, regulated sectors |
A DV certificate provides the same encryption as an OV or EV certificate. The difference is identity assurance, not cryptographic strength. For the vast majority of websites, DV is the right choice. OV and EV matter when a compliance framework, a contract, or a customer explicitly requires verified organisational identity — or when the certificate’s warranty and support terms are part of the requirement.
One historical note: browsers no longer display the green organisation name bar for EV certificates, as they did years ago. The visual distinction that once justified EV for many buyers has largely disappeared.
example.com (often including www.example.com as well, depending on the issuer).*.example.com covering blog.example.com and shop.example.com. Useful when you run many subdomains.Check the certificate’s coverage before you buy or install: a certificate for example.com that does not include www.example.com will produce a warning for visitors who type the www address.
Let’s Encrypt is a non-profit certificate authority that issues DV certificates free of charge. Its certificates are trusted by all major browsers and provide the same encryption as a paid DV certificate. They are valid for 90 days and are designed to be renewed automatically — the short lifetime is deliberate, encouraging automation rather than manual renewal.
Most managed hosting providers now include Let’s Encrypt certificates with automatic renewal. If your hosting includes it, you should rarely need to buy a certificate at all. Paid certificates become worth considering when you need OV or EV validation, a warranty above the free tier, a long validity period for a system that cannot automate renewal, or a CA management portal for dozens of certificates. [TO BE CONFIRMED: whether Offshore Hosting includes free SSL certificates and automatic renewal on its plans — confirm before publishing any such claim.]
The usual sequence on shared or managed hosting:
https:// with no browser warning.http:// are sent to the secure version. In Apache this is typically a rule in .htaccess; in Nginx, a server block redirect.http:// will trigger a browser warning or be blocked. Update internal links and media URLs to HTTPS or to protocol-relative paths.On a VPS or dedicated server you manage yourself, the same steps apply, but you will typically use a client such as Certbot to obtain and renew the certificate, and configure the web server yourself. Automate renewal from the start — a certificate that expires because someone forgot is one of the most common and most avoidable outages.
example.com but the visitor opened www.example.com, or it covers a different domain entirely.http:// links.A quick check you can run yourself from a terminal:
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates -subject
That prints the certificate’s validity dates and the domain it was issued for. Replace example.com with your own domain. It is a read-only check and changes nothing.
Let’s Encrypt certificates last 90 days; paid certificates typically last up to a year. Either way, expiry is a scheduled event, not a surprise — if you monitor it. Put these in place:
If a certificate expires, the fix is to renew and reinstall it — there is no grace period in browsers. Visitors will see a full-page warning until it is fixed.
HTTPS encrypts traffic between the visitor and your server. It does not make your site secure on its own: it does not patch vulnerable software, stop malware, prevent phishing (attackers can get certificates too), or protect data stored on the server. It is one layer — necessary, but not sufficient. Pair it with the rest of the launch discipline in our website launch checklist and with email authentication in how to set up SPF, DKIM, and DMARC.
Discovering your site has been hacked is a bad day that gets worse with the wrong first moves. This guide gives the order of operations: contain, preserve evidence, clean or rebuild, rotate every credential, and harden the site afterwards.
A 99.9% uptime claim allows about 43 minutes of downtime a month — but only if you know what counts, what is excluded, and how to claim. This guide decodes the SLA.
DDoS protection can absorb enormous attacks — and still leave your site down. This guide explains the attack types, the layers of defence, and the honest limits.