Web Development
SSL certificate
An SSL certificate is a digital credential that verifies the identity of a website and enables an encrypted connection between a web server and a browser.
also called: TLS certificate, SSL/TLS
// definition
An SSL certificate, short for Secure Sockets Layer certificate, is a digital data file hosted on an origin server. It contains the public key of a website alongside identity details such as the domain name and issuing authority. Modern certificates use the updated Transport Layer Security, or TLS, protocol, though the industry still commonly refers to them as SSL certificates. When a user navigates to a protected site, the certificate enables a cryptographic handshake to verify ownership and establish an encrypted session.
A trusted third party known as a Certificate Authority issues these files after validating that the applicant owns the domain. This authentication process prevents unauthorized intermediaries from pretending to be the website or intercepting traffic transmitted between the web server and the browser.
// why it matters
Operating a website without a valid SSL certificate exposes user data, such as passwords and payment information, to potential interception. Modern web browsers mark unencrypted websites as unsafe, which warns visitors away and severely reduces user conversion rates. Furthermore, major search engines penalize unencrypted sites in search rankings, directly affecting customer discovery. Obtaining and maintaining an SSL certificate is essential for regulatory compliance, protecting brand reputation, and establishing basic operational credibility for online transactions.
// example
A retail business launches an online store named RetailCorp. When a customer enters credit card details at checkout, the browser checks RetailCorp's SSL certificate against a trusted Certificate Authority. Once verified, the connection changes from unencrypted Hypertext Transfer Protocol to secure Hypertext Transfer Protocol, displaying a padlock icon. The certificate encrypts the payment details during transmission, preventing attackers from reading the data.
Questions and Answers
- What is the difference between SSL and TLS?
- Secure Sockets Layer, or SSL, is the predecessor to Transport Layer Security, or TLS. SSL contains known security vulnerabilities and is deprecated. TLS is the modern, secure protocol used to encrypt web traffic. However, the term SSL certificate is still widely used in the technology industry to refer to certificates that actually run on TLS protocols.
- How long does an SSL certificate remain valid?
- Most public SSL certificates are valid for a maximum period of thirteen months, or 397 days. Industry standards require short lifespans to reduce the risk of compromised keys remaining active for extended periods. Web administrators must renew or replace these certificates annually, or automate the renewal process using automated Certificate Authority services.
- What happens when an SSL certificate expires?
- When an SSL certificate expires, web browsers block immediate access to the website and display a prominent security warning to users. Visitors receive alerts stating that the connection is not private or secure. This interruption halts web traffic, damages user trust, and prevents users from completing secure transactions until a new certificate is installed.