SSL Certificates, Explained (What the Padlock Means)

In short

An SSL certificate is a small file on your server that proves the site is who it claims and lets the browser encrypt everything sent to it.
Without one, browsers label the site Not Secure. With an expired one, they show a full-page warning most visitors will not click past.
Free certificates encrypt exactly as well as paid ones. Paid ones buy a support line and, rarely, an identity check.
The padlock is a floor for trust, not a ceiling. Losing it hurts far more than having it helps.
Mixed content and expiry are the two common ways a site with a certificate still shows a warning. Both are quick fixes.

What the padlock proves, and what it does not

A customer opens your contact page on her phone to send her address and a photo of the leak. Before she types a letter, her browser has already done something she will never see. It asked your server for a certificate, checked who issued it, checked the name on it against the name in the address bar, checked the date, and set up a private channel. Only then did it draw the padlock. If any step failed, she saw a warning instead, and most people who see the warning leave.

An SSL certificate is the file that makes that check pass. It is issued by a company called a certificate authority, it is installed on the server that hosts your site, and it does two jobs. First, it proves that the server answering for yourbusiness.com is the one entitled to answer for it. Second, it gives the browser a key to encrypt everything it sends, so a form, a password or a card number cannot be read on the way. The technical name for the current version is TLS. Everyone still says SSL, including the companies that sell it, so this guide does too.

Here is what the padlock does not prove. It does not prove the business is honest, licensed or real, or that the site is free of malware. A scam site can have a perfect padlock, and most now do, because certificates are free. The padlock says the connection is private and the address is genuine. Trust in the business comes from everything else on the page, and the credibility checklist covers that.

The padlock is not a sign that a business can be trusted. Its absence is a sign that the business is not paying attention.

How it works, in five steps

1
The browser asks.
A visitor types your address. The browser connects to your server and says, in effect, show me your certificate.
2
The server presents it.
The certificate names the domain it covers, the authority that issued it, the date it expires, and a public key.
3
The browser checks the issuer.
Every browser ships with a list of authorities it trusts. If the certificate was issued by one of them, and the chain of signatures checks out, it passes. If not, warning.
4
The browser checks the name and date.
The name on the certificate must match the address bar, including whether it covers www and the bare domain. The date must not have passed. This is where most real-world failures happen.
5
The two agree on a secret.
Using the public key, the browser and server agree on an encryption key nobody else can derive. From then on, everything between them is scrambled. The padlock appears.

All of this takes a few dozen milliseconds on good hosting. On poor hosting it is one more delay stacked on the others the speed guide describes.

Why browsers warn, and what visitors do when they see it

For most of the web's history a site without a certificate looked the same as a site with one. That ended around 2018, when the major browsers began labeling every plain http page Not Secure in the address bar, on every page, whether or not the page asks for anything.

There are two levels of warning. The first is that label. It costs a little trust on every visit and is a loud tell to anyone who knows what it means. The second is the full-page interstitial: a red or gray screen that says the connection is not private, with a small "advanced" link that leads to a smaller "proceed anyway." This appears when a certificate has expired, covers the wrong name, or was issued by an authority the browser does not know. Most visitors do not proceed. They hit back and choose the next business in the results.

Search engines add their own weight. Google confirmed https as a ranking factor in 2014, and while it is a small one, Chrome's warnings are not. A site that throws an interstitial for a week in a busy season loses more than a ranking; it loses the week. The SEO checklist lists https as the first technical item for this reason.

Free versus paid certificates

Here is the part the hosting industry would rather you did not read. The encryption provided by a free certificate is identical to the encryption provided by a $300 one. Same algorithms, same key lengths, same padlock. Free certificates from Let's Encrypt and similar authorities are issued automatically, renew automatically every 90 days, and are used by a large share of all sites on the web. Most good hosts install one without being asked.

What a paid certificate buys is different from what the price suggests.

Type	What is checked	What you get	Who needs it
Domain validated, free	That you control the domain	Full encryption, the padlock, automatic renewal	Almost every small business site
Domain validated, paid	The same	The same, plus a support line and sometimes a warranty	Sites on hosts that cannot automate the free kind
Organization validated	That the business exists and owns the domain	The business name inside the certificate details, which almost nobody opens	Larger companies with a compliance checkbox
Extended validation	A deeper identity check	Once, a green bar with the company name. Browsers removed it in 2019.	Banks, by habit
Wildcard	Domain control, for every subdomain	One certificate for shop., app., portal. and the rest	Sites with several subdomains

"Validated" describes what the authority checked before issuing, not how strong the encryption is. The encryption is the same on every row.

The practical rule: if a host or developer charges $50 to $200 a year for a certificate on a normal business site, ask why the free one will not do. There are honest answers, mostly about old hosting that cannot automate renewal. There are also invoices that list "SSL" because it sounds important. The hosting guide explains which line items a hosting bill should have; this one should usually be zero.

How to check your own certificate in two minutes

Open your site on a phone and on a laptop. Look for the padlock or the Not Secure label in the address bar. Check the home page and the contact page.
Type your address with http:// in front. It should switch to https on its own. If it loads as plain http, the redirect is missing and half your visitors are arriving unprotected.
Try the address with and without www. Both should load with the padlock. A certificate that covers one and not the other is a common leftover from a rushed setup.
Click the padlock and view the certificate. Note the expiry date. Put a reminder two weeks before it, unless the host confirms it renews on its own.
Open a page that shows images and look for a broken padlock, an info icon or a warning triangle where the padlock should be. That is mixed content, covered below.
Run the free site audit. It checks the certificate, the redirect and the security headers together and puts them in one report.

The two ways a site with a certificate still warns

Mixed content is the common one. The page loads over https, but something on it, an image, a script, a font, is still called over plain http, usually because it was pasted in years ago. The browser sees an encrypted page carrying unencrypted parts and downgrades the padlock, or blocks the part outright. Images vanish. A slider stops. A form that depended on the blocked script goes quiet. The fix is to find every http:// reference in the content and change it: a database search-and-replace on WordPress, a five-minute job on a custom site. The broken site repair service sees this weekly.

Expiry is the dramatic one. A certificate set up by hand and never automated will lapse, often on a weekend, and the site goes from padlock to full-page warning in one second. The steps back are short.

If your certificate has expired

1
Confirm it is the certificate.
Click through the warning once, on your own device, and read the reason. "Expired" and "name mismatch" are certificate problems. Other messages may mean the site was compromised, which is a security cleanup rather than a renewal.
2
Log in to the host.
Most hosting panels have an SSL section with a renew or reissue button. For a free automated certificate, forcing a renewal usually fixes it in minutes.
3
If it is paid, renew it with the authority.
Then install the new file on the server. This is the step that used to take a developer an hour, and it is why automated free certificates won.
4
Set it to renew itself.
Do not leave it manual again. Every good host can automate this. If yours cannot, that is a reason to move.

Free · takes a minute

Find out what your site is actually doing.

A free audit scores your site on speed, mobile, SEO and security, and lists the fixes in order of what they are worth. Delivered as a PDF to your inbox.

Run the free audit Or just ask a person

Go deeper

Free · No obligation

Want a plain-language answer to a technical question?

Tell us what you have been told, or what you are paying for, and a developer will explain it in words you can repeat to your partner. Free, no jargon, no pitch.

Which of these sounds like you? (pick any)

Questions people ask

Straight answers

It is a file installed on a website's server that proves the site is who it claims to be and lets the visitor's browser encrypt everything it sends. When the certificate checks out, the browser shows a padlock and the address starts with https. Without it, the browser labels the site Not Secure.

Yes. Browsers mark sites without one as Not Secure on every page, and they warn sharply on any page with a form. Google uses https as a ranking signal. Since free certificates are standard on any decent host, there is no reason for a business site not to have one.

The encryption is identical. Free certificates from authorities like Let's Encrypt use the same algorithms and key lengths as paid ones and produce the same padlock. Paid certificates add a support line, occasionally a warranty, and in some types an identity check on the business. For a typical business site, free is the correct choice.

Usually one of three things: the site is not redirecting http to https, so visitors land on the unencrypted version; the certificate covers www but not the bare domain or the reverse; or the page contains mixed content, meaning an image or script still loading over http. Each is a quick fix once identified.

Free automated certificates last 90 days and renew themselves. Paid certificates have typically been issued for one year, and browser rules are shortening the maximum life further. The practical answer is that on a well-run host it never lapses, because renewal is automatic, and on a poorly-run one it lapses on a weekend.

Slightly and directly, since Google has treated https as a ranking signal since 2014. Much more indirectly, because a Not Secure label or a full-page warning sends visitors back to the results, and a page people leave immediately does not hold its position for long.

Where to go from here

SSL Certificates, Explained