What Is an SSL Certificate and Why Is It Important?

The padlock in the browser's address bar and the "https://" at the start of a URL both depend on an SSL certificate. Certificates are so common today that they're easy to forget about, until one expires and visitors are greeted by a full-page security warning. This article explains what certificates are, how they work, why they matter and how to avoid certificate-related outages.

SSL, TLS and HTTPS

SSL (Secure Sockets Layer) was the original protocol for encrypting web traffic. It has long been replaced by TLS (Transport Layer Security), and all SSL versions are now considered insecure. The name "SSL certificate" stuck, but the certificates you use today are used with TLS, typically TLS 1.2 or TLS 1.3.

HTTPS is simply HTTP sent over a TLS-encrypted connection. When a website uses HTTPS, the data exchanged between the browser and the server is encrypted and protected against tampering.

What does a certificate actually do?

A certificate is a digitally signed file that binds a public key to one or more domain names. It serves two purposes:

1. Authentication: it proves to the browser that the server it's talking to is really authorised to serve example.com, not an impostor intercepting the connection.
2. Enabling encryption: the public key in the certificate is used during the TLS handshake to establish the encryption keys for the session.

Without authentication, encryption alone wouldn't be enough: you could have a perfectly encrypted connection to an attacker.

How browsers check a certificate

When a browser connects to an HTTPS website, the server presents its certificate, usually together with one or more intermediate certificates. The browser then checks:

• Trust chain: the certificate must be signed, directly or through intermediates, by a certificate authority (CA) the browser or operating system trusts.
• Domain name: the domain being visited must be listed in the certificate (in the Subject Alternative Name field). A certificate for example.com doesn't automatically cover shop.example.com unless that name, or a wildcard such as *.example.com, is included.
• Validity period: the current date must be between the certificate's "not before" and "not after" dates.
• Revocation and policy: browsers also apply additional checks and requirements set by the industry.

If any check fails, the browser shows a warning such as "Your connection is not private" and most visitors leave. You can see the details of any public website's certificate with our SSL certificate checker.

Types of certificates

By validation level

• Domain Validation (DV): the CA verifies only that the applicant controls the domain. DV certificates can be issued automatically within minutes and are the most widely used type. They provide the same encryption strength as other types.
• Organization Validation (OV): the CA also verifies the organisation behind the domain.
• Extended Validation (EV): a stricter organisation check. Browsers no longer give EV certificates a prominent visual indicator, so their practical advantage for most websites is limited.

By coverage

• Single-domain: one name, such as www.example.com (often with the bare domain included as well).
• Multi-domain (SAN): several specific names in one certificate.
• Wildcard: all first-level subdomains, such as *.example.com.

Why SSL certificates are important

Security and privacy

HTTPS protects passwords, form submissions, payment details and personal data from being read or altered by anyone between the visitor and the server, such as on a public Wi-Fi network.

Trust and browser behaviour

Modern browsers label plain HTTP pages as "Not secure", particularly when they contain forms. Many browser features, including geolocation and service workers, are only available on secure origins.

Search engines

Google has used HTTPS as a ranking signal since 2014. It's a lightweight signal compared with content quality, but there's no reason to give it up.

Availability

This is the part that's easy to overlook: a certificate problem makes your website effectively unavailable. Browsers block access with an interstitial warning, and automated clients such as APIs and mobile apps often fail outright. From a visitor's point of view, an expired certificate is downtime.

Certificate expiry: the predictable outage

Every certificate has a fixed lifetime. Under rules agreed by the CA/Browser Forum, the maximum lifetime of publicly trusted certificates has been reduced to 200 days since March 2026, with further reductions scheduled in stages until 2029, when the maximum will be 47 days. Free certificates from Let's Encrypt are valid for 90 days and are designed to be renewed automatically.

Shorter lifetimes improve security, but they also mean renewal must work reliably. Automated renewal using the ACME protocol handles this for most websites. Renewals still fail occasionally, for example when:

• the website moved to a new server and the renewal job didn't move with it;
• a DNS or firewall change blocks the CA's validation request;
• a renewed certificate was obtained but the web server was never reloaded to use it;
• a certificate was installed manually and nobody remembered the expiry date;
• a CDN or load balancer uses its own certificate that is managed separately.

Because expiry dates are known in advance, these outages are entirely preventable, as long as someone is watching.

Other common certificate errors

• Name mismatch: the certificate doesn't cover the domain being visited, for example the www version is missing.
• Incomplete chain: the server doesn't send the intermediate certificate. Some browsers can work around it, but other clients fail.
• Self-signed certificate: not issued by a trusted CA. Acceptable for internal testing, not for public websites.
• Mixed content: the page loads over HTTPS but includes images or scripts over HTTP, which browsers block or flag.

How to keep your certificates healthy

1. Automate renewal with an ACME client or your hosting provider's built-in certificate management.
2. Cover every name you use, including www and any subdomains.
3. Redirect HTTP to HTTPS with a single 301 redirect, and consider enabling HSTS once everything works over HTTPS.
4. Check the result after changes. The SSL checker shows trust status, covered names, the expiry date and the TLS version.
5. Monitor expiry independently. UptimeStats records the certificate's expiry date and issuer on every HTTPS check of your monitored websites and shows the days remaining, and a failed certificate turns into a confirmed outage alert with the reason "SSL certificate has expired".

For other common reasons websites go offline, read What Causes Website Downtime?

Summary

SSL/TLS certificates authenticate your website and enable encrypted HTTPS connections. They're essential for security, trust and search visibility, and a certificate problem is effectively an outage. Automate renewal, cover every domain name you use and keep an independent eye on expiry dates.