Every website needs an SSL certificate. Without one, browsers display security warnings, search engines penalize your rankings, and your users' data travels across the internet unencrypted. Here is everything you need to know about SSL certificates: what they are, the different types, how to set one up, and how to troubleshoot common issues.
What is SSL/TLS?
SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are cryptographic protocols that encrypt communication between a web browser and a server. When you see the padlock icon and "https://" in your browser's address bar, TLS is encrypting the connection.
Although everyone still says "SSL," modern implementations actually use TLS (currently TLS 1.3). The term "SSL certificate" is a legacy name that stuck.
An SSL certificate does three things:
- Encryption: Protects data in transit from being read by third parties.
- Authentication: Verifies that the server is who it claims to be.
- Integrity: Ensures data has not been tampered with during transmission.
Types of SSL Certificates
Domain Validation (DV)
DV certificates verify only that you control the domain. The Certificate Authority (CA) checks via DNS record, email, or HTTP file validation. They are issued in minutes and are the simplest and cheapest option.
Best for: Personal websites, blogs, small business sites, development environments.
Organization Validation (OV)
OV certificates verify domain ownership and the existence of the organization behind it. The CA checks business registration documents. They take one to three days to issue and display the organization name in the certificate details.
Best for: Business websites, e-commerce stores, and applications that handle user data.
Extended Validation (EV)
EV certificates involve the most rigorous verification process. The CA verifies legal, physical, and operational existence of the organization. They can take one to two weeks to issue.
EV certificates used to display the company name in a green address bar, but most browsers have removed this visual distinction. The practical security benefit over OV is debatable in 2026, and many organizations have moved away from EV.
Best for: Financial institutions, large enterprises with strict compliance requirements.
Wildcard Certificates
A wildcard certificate covers a domain and all its subdomains. For example, a wildcard for *.example.com covers www.example.com, api.example.com, mail.example.com, and any other subdomain.
Best for: Organizations running multiple subdomains that want simplified certificate management.
Multi-Domain (SAN) Certificates
Subject Alternative Name (SAN) certificates cover multiple different domains under a single certificate. Useful when you manage several related domains.
Free vs Paid Certificates
Let's Encrypt (Free)
Let's Encrypt is a nonprofit Certificate Authority that provides free DV certificates. It has fundamentally changed the SSL landscape since its launch. Key features:
- Free DV certificates
- Automated issuance and renewal via the ACME protocol
- 90-day certificate lifetime (encourages automation)
- Wildcard certificate support
- Trusted by all major browsers
For the vast majority of websites, Let's Encrypt is the right choice. There is no security difference between a free DV certificate and a paid one.
Paid Certificates
Paid certificates from CAs like DigiCert, Sectigo, or GlobalSign make sense in specific scenarios:
- You need OV or EV validation
- You need warranty coverage (some paid certs include insurance)
- Your compliance requirements mandate specific CAs
- You want longer certificate lifetimes (though the industry is moving toward shorter validity periods)
Installing Let's Encrypt with Certbot
Certbot is the standard tool for obtaining and managing Let's Encrypt certificates. Here is the process for an Nginx server on Ubuntu:
sudo apt updatechr(10)sudo apt install certbot python3-certbot-nginxchr(10)sudo certbot --nginx -d example.com -d www.example.comCertbot automatically:
- Obtains the certificate
- Configures Nginx to use it
- Sets up HTTP-to-HTTPS redirect
- Configures auto-renewal via a systemd timer
To verify auto-renewal is working:
sudo certbot renew --dry-runFor Apache servers, use python3-certbot-apache instead and run certbot --apache.
Common SSL Errors and How to Fix Them
Mixed Content Warnings
Your page loads over HTTPS, but some resources (images, scripts, stylesheets) load over HTTP. The browser flags this as insecure. Fix by updating all resource URLs to HTTPS or using protocol-relative URLs.
Certificate Expired
Let's Encrypt certificates expire every 90 days. If auto-renewal fails, your site shows a frightening "Your connection is not private" error. Check that the Certbot timer is running and that port 80 is accessible for validation.
Certificate Name Mismatch
The domain in the certificate does not match the URL. This happens when you access the site via a domain or subdomain that is not included in the certificate. Add the missing domain with certbot --expand.
Intermediate Certificate Missing
The browser cannot build a trust chain from your certificate to a trusted root CA. Install the intermediate certificate bundle provided by your CA. Tools like SSL Labs' SSL Test will identify this issue.
TLS Version Too Old
Some older configurations still support TLS 1.0 or 1.1, which are deprecated and considered insecure. Configure your server to support only TLS 1.2 and 1.3:
# Nginxchr(10)ssl_protocols TLSv1.2 TLSv1.3;Monitoring Your SSL Certificates
Do not wait for a certificate to expire and take your site down. Set up monitoring:
- SSL Labs Test (ssllabs.com/ssltest): Comprehensive free analysis of your SSL configuration, graded A through F.
- Uptime monitors: Services like UptimeRobot or Pingdom can alert you when your certificate is approaching expiration.
- Certificate Transparency logs: Monitor for unauthorized certificates issued for your domain.
Check your certificates at least monthly. Automated monitoring is better, sending you alerts 30, 14, and 7 days before expiration.
SSL Best Practices
- Always redirect HTTP to HTTPS: Never serve content on both protocols.
- Use HSTS (HTTP Strict Transport Security): Tells browsers to always use HTTPS for your domain.
- Enable OCSP stapling: Speeds up certificate validation by stapling the CA's response to your TLS handshake.
- Use strong cipher suites: Disable weak ciphers and prioritize forward secrecy.
- Automate renewal: Never rely on manual renewal. Certbot and similar tools handle this automatically.
SSL is not optional in 2026. It is a fundamental requirement for any website. The good news is that between Let's Encrypt and modern tooling, getting it right is easier than ever.
