Knowledge base — Definition
SSL Certificate
What an SSL certificate (SSL/TLS) is, how DV, OV and EV validation differ, and how to install, renew and monitor certificates without breaking HTTPS.
What Is an SSL Certificate?
An SSL certificate is a small digital file, issued by a trusted certificate authority (CA), that binds a domain name to a cryptographic public key so a browser can confirm it is talking to the real site and set up an encrypted connection. The name is historical: the original SSL protocol has long been retired, and today's connections use TLS 1.2 or TLS 1.3. "SSL certificate" and "TLS certificate" mean the same thing.
When someone visits your site over HTTPS, your server presents its certificate. The browser checks that it was signed by a CA it trusts, that it covers the exact hostname in the address bar, and that it has not expired or been revoked. If every check passes, the browser and server agree on session keys and everything that follows (passwords, form entries, cookies, order details) travels encrypted. If any check fails, the visitor sees a full-page security warning instead of your site.
Why an SSL Certificate Matters
A valid certificate is now a baseline requirement for any public website, not just stores.
- Privacy of visitor data: Contact forms, logins and newsletter sign-ups all carry personal information, and PIPEDA expects organizations to protect it with safeguards appropriate to its sensitivity.
- Browser warnings: Chrome, Safari, Firefox and Edge label plain HTTP pages as "Not Secure", and an expired or mismatched certificate produces an error page most visitors will not click past.
- Search visibility: Google has used HTTPS as a lightweight ranking signal since 2014, and HTTPS is a prerequisite for modern features such as HTTP/2, HTTP/3 and service workers.
- Integrity of your pages: Encryption stops networks such as public Wi-Fi from injecting ads, scripts or altered content into your pages in transit.
- Payments and compliance: Payment providers and PCI DSS require strong encryption on any page involved in taking card data.
How SSL Certificates Work
- Validation level: Domain Validated (DV) certificates prove only that you control the domain and are issued in minutes. Organization Validated (OV) certificates also verify the legal business behind it. Extended Validation (EV) adds stricter checks, but major browsers stopped showing the company name in the address bar in 2019, so EV no longer gives visitors a visible benefit.
- Coverage: A single-domain certificate covers one hostname, often with and without
www. A wildcard (*.example.ca) covers every first-level subdomain. A multi-domain (SAN) certificate lists several specific hostnames on one certificate. - Certificate chain: Your certificate is signed by an intermediate certificate, which is signed by a root the browser already trusts. The server must send the intermediate too, or some devices will reject the connection.
- Validity and renewal: Certificates expire by design. Industry rules set by the CA/Browser Forum are shortening maximum lifetimes in stages through 2029, which makes automated renewal through the ACME protocol (used by Let's Encrypt and many hosts) the practical standard.
- Revocation and transparency: A CA can revoke a certificate if its key is compromised, and every publicly trusted certificate is recorded in public Certificate Transparency logs, which you can search to spot certificates issued for your domain.
Common SSL Certificate Mistakes
- Manual renewals: A certificate renewed by hand once a year is the most common cause of a site suddenly showing a security error, usually discovered by a customer.
- Mixed content: Images, scripts or fonts still loaded over
http://on an HTTPS page are blocked or flagged by browsers, which can break layouts and remove the secure indicator. - Missing hostnames: A certificate for
example.cathat does not includewww.example.ca, or a staging or shop subdomain, triggers a name-mismatch error on the uncovered address. - No HTTP-to-HTTPS redirect: Installing a certificate but leaving the HTTP version reachable splits traffic, duplicates pages for search engines and leaves the first request unencrypted.
- Paying for EV for the wrong reasons: Buying an expensive EV certificate expecting a green bar or a trust boost that browsers no longer display.
Best Practices for SSL Certificates
- Automate renewal: Use your host's built-in Let's Encrypt or ACME integration and confirm it renews well before expiry rather than on the last day.
- Monitor expiry externally: Add an uptime or certificate monitor that alerts you by email if expiry is approaching or the chain changes, independent of your host.
- Redirect and enforce: Send every HTTP request to HTTPS with a single 301 redirect, update the site URL in WordPress, and add an HSTS header once you are sure every subdomain supports HTTPS.
- Clean up mixed content: Search the database and theme for hard-coded
http://URLs, and use the browser console to catch anything left. - Harden the configuration: Disable TLS 1.0 and 1.1, prefer TLS 1.3, and check the result with a public scanner such as Qualys SSL Labs.
- Restrict who can issue: Add a CAA record in your DNS naming the CAs allowed to issue certificates for your domain.
SSL Certificates at PerfectPixels
On every site we build or maintain, we set up automated certificate renewal, force HTTPS with clean redirects and HSTS, remove mixed content, and add expiry monitoring so a lapsed certificate never reaches your visitors. When a project involves several subdomains, a migration to new hosting or an online store, we plan certificate coverage before launch day, as part of our web design and development and WordPress maintenance work.
Frequently Asked Questions
Is a free SSL certificate as secure as a paid one?
Yes, for encryption. A free DV certificate from Let's Encrypt uses the same TLS protocols and key strengths as a paid DV certificate. Paid certificates make sense when you need OV or EV validation for a procurement or compliance requirement, or a vendor support contract.
Do I need an SSL certificate if my site does not sell anything?
Yes. Any site with a contact form, login or analytics cookies handles personal information, and browsers mark every HTTP page as "Not Secure" regardless of content. Most hosts include a free certificate, so there is no good reason to run without one.
What happens when my SSL certificate expires?
Browsers show a full-page warning that the connection is not private, and most visitors leave. APIs, payment webhooks and integrations that call your site may also stop working. Renewing restores access immediately, but automated renewal plus monitoring prevents the outage in the first place.
Related Resources
Further reading: Why HTTPS matters — web.dev.