That padlock in your browser's address bar is powered by something called an SSL certificate — and these days, a website without one is flagged as "Not Secure" and quietly loses visitors and trust. But what actually is an SSL certificate, why does every site need one, and which type should you get? Here's a plain-English guide that clears it all up, whether you're securing your own site or just curious what the padlock really means.

What is an SSL certificate?

An SSL certificate (technically a TLS certificate today, though the old name stuck) is a small digital file installed on a website's server. It does two essential jobs:

  • Encryption — it scrambles the data traveling between a visitor's browser and the site, so passwords, card numbers, and personal details can't be read by anyone snooping on the connection.
  • Authentication — it proves the site is who it claims to be, because it's issued by a trusted Certificate Authority (CA) that verifies the requester first.

When a site has a valid certificate, its address becomes the secure https:// and the browser shows a padlock. Without one, browsers use plain http:// and warn visitors that the site isn't secure.

How an SSL certificate works (in brief)

When you connect to a secure site, your browser and the server perform a quick TLS handshake: they agree on encryption, and the server presents its certificate. Your browser checks that the certificate is valid, unexpired, issued for the right domain, and signed by a trusted authority. If everything checks out, an encrypted connection opens and the page loads securely. If not, you get a warning like the one covered in our guide on fixing "Your connection is not private".

Types of SSL certificates

Certificates differ in two ways: how thoroughly the owner is verified, and how many domains they cover.

By validation level

  • Domain Validated (DV) — the CA only confirms you control the domain. It's fast, often free, and fine for blogs, personal sites, and most small websites. The vast majority of certificates today are DV.
  • Organization Validated (OV) — the CA also verifies the organization behind the site, offering a higher level of assurance. Common for business and corporate sites.
  • Extended Validation (EV) — the most rigorous checks, historically used by banks and large e-commerce sites to signal maximum trust. (Modern browsers no longer show the old "green bar," but the vetting is still the strictest.)

Importantly, all three provide the same strength of encryption — the difference is how much the owner's identity is verified, not how secure the connection is.

By coverage

  • Single-domain — secures one specific domain (e.g. example.com).
  • Wildcard — secures a domain and all its subdomains (*.example.com), so blog., shop., and app. are all covered by one certificate.
  • Multi-domain (SAN/UCC) — secures several different domains under a single certificate.

Which coverage you need depends on your setup — a single site needs a single-domain certificate, while a site with many subdomains is better served by a wildcard.

Why every website needs one

An SSL certificate isn't optional anymore. Here's why every site should have one:

  • Security. Any data your visitors enter — logins, payments, contact forms — must be encrypted in transit. Without SSL, it travels in plain text that can be intercepted.
  • Trust. Browsers label HTTP sites as "Not Secure," which scares visitors away. A padlock reassures them the site is legitimate and safe to use.
  • SEO. Google treats HTTPS as a ranking signal, so a secure site has a search advantage over an insecure one.
  • Browser requirements. Modern browsers actively warn on (or block features for) non-HTTPS sites, and many web features simply won't work without it.
  • Payments and compliance. Accepting card payments requires encryption; you can't run a legitimate checkout on an unsecured site.

In short, SSL has gone from a "nice to have" to a baseline requirement for being online at all.

How to get an SSL certificate

The good news: securing a site is usually free and easy. Let's Encrypt issues free DV certificates that renew automatically, and most web hosts now include free SSL with hosting and set it up for you with a click. Paid certificates (OV, EV, or wildcards from commercial CAs) are worth it when you need organization validation or specific coverage. Whichever you choose, enable auto-renewal — certificates expire (often every 90 days for free ones), and a lapsed certificate takes your site's security — and sometimes the whole site — offline.

How to check your certificate

Once installed, it's worth confirming your certificate is valid and won't expire unexpectedly. Enter your domain into our free SSL Certificate Checker to see its issuer, validity dates, and coverage — our guide on how to check an SSL certificate explains what to look for. And remember: a certificate secures the connection, but it doesn't guarantee a site is trustworthy — our guide on how to tell if a website is safe covers the bigger picture.

The bottom line

An SSL certificate is the file that encrypts your connection to a website and proves the site's identity, turning http:// into the secure https:// with its reassuring padlock. They come in different validation levels (DV, OV, EV) and coverage types (single-domain, wildcard, multi-domain), but all provide the same strong encryption. Every website needs one — for security, trust, SEO, and browser compatibility — and thanks to free providers like Let's Encrypt, there's no reason not to have one. Set it up, turn on auto-renewal, and check it now and then, and your site stays secure and trusted.