HTTPS and SSL Certificates Explained: What Owners Should Check
What HTTPS and TLS protect, how certificates work, why browsers show warnings, where free certificates come from, and what to check on your own site.
How to Redesign a Website · Last reviewed October 19, 2026 · 5 min read
Look at the address bar of almost any website today and you'll see that it begins with https rather than plain http, usually alongside a small icon you can click for connection details. That extra letter matters. It means the connection between the visitor's browser and the website is encrypted and the site has proved, with a digital certificate, that it controls the domain name.
For a small business, HTTPS is no longer optional. Browsers flag sites without it, visitors are wary of forms on unsecured pages, and Google lists HTTPS as part of page experience. The good news is that it is now inexpensive and often automatic. This guide explains what it does, how certificates work, and what you should check on your own site.
What HTTPS Actually Does
HTTP (Hypertext Transfer Protocol) is the language browsers and servers use to request and deliver web pages. HTTPS is the same thing sent over a secure connection created by a protocol called TLS (Transport Layer Security).
According to MDN Web Docs, TLS provides three protections:
- Encryption, so people on the same network or along the route can't read what is being sent
- Authentication, so the browser can confirm it is talking to the real server for that domain
- Integrity, so the data can't be quietly altered on the way
A simple analogy: plain HTTP is like mailing a postcard that anyone handling it can read or alter. HTTPS is like a sealed, tamper-evident envelope that only the intended recipient can open.
It's equally important to know what HTTPS doesn't do. It does not prove a business is honest, since scam sites can obtain certificates too. It doesn't protect information once it is stored on your server, and it won't stop malware if the site itself has been compromised. It secures the journey, not the destination.
SSL or TLS? A Note on Names
SSL (Secure Sockets Layer) was the original protocol for securing web connections. It was replaced long ago by TLS, its successor. MDN notes that modern browsers expect TLS 1.2 or 1.3, and that major browsers began removing support for the older TLS 1.0 and 1.1 in early 2020.
Despite this, the phrase SSL certificate has stuck. When a host or registrar sells an SSL certificate, they mean the same certificate used for TLS connections.
What a Certificate Is
A certificate is a small digital document that ties a domain name to a cryptographic key. It is issued and digitally signed by a certificate authority (CA), an organization that browsers have agreed to trust. When someone visits your site, the browser checks that the certificate was issued by a trusted CA, that it covers the exact name being visited, and that it hasn't expired or been revoked.
Most small-business sites use domain-validated certificates, which confirm that the applicant controls the domain. Other types also involve checking details about the organization, which some businesses choose for their own reasons.
Certificates expire on purpose. Under rules agreed by the CA/Browser Forum, the industry body of certificate authorities and browser makers, the maximum lifetime for publicly trusted certificates fell to 200 days in March 2026. It is scheduled to drop to 100 days in March 2027 and 47 days in March 2029. Shorter lifetimes limit the damage if a key is ever compromised, but they make automatic renewal essential.
Why Browsers Show Warnings
Browser warnings usually point to one of these problems:
- The certificate has expired, often because automatic renewal quietly failed
- The certificate doesn't cover the name being visited, such as a certificate for example.com used on www.example.com
- The certificate wasn't issued by a trusted authority, for example a self-signed certificate
- The page is secure but loads some images or scripts over plain HTTP, known as mixed content, which browsers may block or flag
- The site doesn't offer HTTPS at all
That last case is getting more visible. Major browsers already mark plain HTTP pages as not secure. Google has also announced that starting with Chrome 154, scheduled for October 2026, Chrome will turn on its Always Use Secure Connections setting by default, asking for the visitor's permission before first loading a public site that doesn't support HTTPS.
A full-page warning is one of the fastest ways to lose a potential customer, because most people will simply leave.
Free Certificates and Let's Encrypt
Certificates used to cost money and require manual installation. Today, Let's Encrypt, a free, automated and open certificate authority run by the nonprofit Internet Security Research Group (ISRG), issues certificates at no cost to anyone who controls a domain. It uses an open standard called ACME that lets server software request, install and renew certificates automatically. Many hosts and website builders use Let's Encrypt or similar services to provide HTTPS by default.
Let's Encrypt certificates currently last 90 days. The organization has announced plans to shorten that, with its default certificates moving to 64 days in February 2027 and 45 days in February 2028. If renewal is automated, most site owners won't need to do anything.
Paid certificates still exist. They don't make the encryption itself stronger. What you pay for is a different validation type, customer support or other extras.
What Owners Should Check
A few minutes of checking can save a lot of trouble:
- Type your address with the plain http prefix rather than https, and confirm the browser is automatically redirected to the secure version.
- Check both the www and non-www versions of your domain load securely without warnings.
- Click the icon beside the address bar, view the certificate details, and note who issued it and when it expires.
- Ask your host or developer whether renewal is automatic and who receives alerts if it fails.
- Check pages with forms, such as contact and checkout pages, for mixed content warnings.
- Remember subdomains, such as a booking or shop subdomain, which may need their own coverage.
- Re-run these checks after any redesign, host move or domain change.
Key takeaways
- HTTPS encrypts the connection, confirms the site's identity and protects data from tampering in transit, but it doesn't prove a business is trustworthy.
- SSL certificate and TLS certificate mean the same thing in everyday use; TLS is the modern protocol.
- Certificate lifetimes are getting shorter, so automatic renewal is essential.
- Free certificates from Let's Encrypt and similar services provide the same encryption as paid ones.
- Check redirects, expiry dates, subdomains and mixed content, especially after a redesign.
Sources
Spotted something out of date? Let us know.