SSL certificate

An SSL certificate is a small data file installed on a web server that encrypts the connection to a visitor's browser and proves the site's identity. It is what turns a plain http:// address into a secure https:// one, with the padlock icon browsers show next to the URL. Without it, any data exchanged between a visitor and a site, passwords, payment details, form submissions, travels in plain text and can be intercepted. SSL certificates are now the baseline for any website, not an optional extra.

What is an SSL certificate?

An SSL certificate (Secure Sockets Layer certificate) is a digital file issued by a trusted certificate authority (CA) that binds a cryptographic key pair to a domain name and, for higher validation levels, an organisation. It lets a server prove it really is the domain it claims to be, and it provides the public key browsers use to start an encrypted session. The name SSL is a holdover: the underlying protocol has been TLS (Transport Layer Security) for years, but "SSL certificate" remains the common term for both.

Every certificate has an expiry date, a chain of trust back to a root CA, and a scope, meaning the exact domain(s) it covers. A certificate for example.com does not automatically secure shop.example.com unless it was issued to cover it.

How the SSL/TLS handshake works

When a browser connects to a site over HTTPS, it performs a TLS handshake before any page content loads. The server presents its certificate, the browser checks it against the CA's public key and the chain of trust, and both sides agree on a session key used to encrypt everything that follows. This happens in a fraction of a second and is invisible to the visitor beyond the padlock appearing.

You can inspect a live certificate from a terminal:

openssl s_client -connect bebranded.xyz:443 -servername bebranded.xyz

The output shows the issuer, the validity dates and the exact domains covered, useful when debugging a renewal or a misconfigured chain.

Types of SSL certificates

Certificates differ along two axes: validation level and domain coverage.

• Domain Validation (DV): confirms only that the requester controls the domain. Fast to issue, often free (Let's Encrypt), and enough for most sites.
• Organisation Validation (OV): also verifies the legal existence of the business behind the domain.
• Extended Validation (EV): the strictest check, requiring documented proof of the organisation. Browsers no longer highlight EV visually the way they once did, so its practical benefit over OV is limited today.
• Single-domain: covers exactly one hostname.
• Wildcard: covers a domain and all its first-level subdomains (*.example.com).
• Multi-domain (SAN): covers a list of unrelated domains under one certificate.

SSL certificate vs plain HTTP

Best practices and common pitfalls

Most certificate incidents are avoidable. Letting a certificate expire silently breaks the entire site with a browser warning; automated renewal (Let's Encrypt certificates renew every 90 days) removes that risk. Mixed content, loading an image or script over plain http:// on an HTTPS page, breaks the padlock and can block the resource entirely. Issuing a certificate for the wrong set of subdomains, or forgetting a wildcard when new subdomains launch, causes warnings that erode visitor trust. Certificates issued through a CDN or host (Cloudflare, for instance) are usually renewed automatically, which removes most manual maintenance.

Why SSL matters for SEO and trust

HTTPS has been a confirmed Google ranking signal since 2014, and modern browsers actively warn visitors away from HTTP pages that collect input. Beyond rankings, an SSL certificate is what allows a browser to use HTTP/2, service workers and other performance features reserved for secure origins, which ties directly into Core Web Vitals. A site without a valid certificate loses trust, traffic and technical capability at the same time.

SSL certificates at BeBranded

Every site we deliver ships with HTTPS enforced from day one, certificate renewal automated, and no mixed content left behind. It is one of the baseline checks in every website we design or rebuild, so your visitors never see a security warning.