What is an SSL certificate?

What it means

An SSL certificate proves a website is who it says it is and lets the browser set up an encrypted connection. With one, your address starts with https:// instead of http://.

Visitors notice when it’s missing. Since Chrome 68 in July 2018, Google Chrome has marked every plain HTTP site as “Not secure.”

The name is a leftover. Modern certificates use a newer protocol called TLS, but almost everyone still says SSL.

How it works

A certificate is issued by a certificate authority (CA), an organization that browsers trust. The CA checks that you control the domain, then signs a certificate for it.

Your server shows that certificate to each visitor’s browser. The browser checks the signature and the expiry date, then the two sides agree on a key to encrypt the traffic. It all happens before the page appears.

Certificates expire on purpose, and the limits are getting shorter. The CA/Browser Forum, the group of browser makers and CAs that sets the rules, voted in April 2025 to cut the maximum lifetime of public certificates in steps:

Let’s Encrypt, the free and automated CA, issues 90-day certificates by default today. According to Let’s Encrypt’s announcement, it offers opt-in 45-day certificates from May 13, 2026, moves its default to 64 days on February 10, 2027, and to 45 days on February 16, 2028.

The takeaway: renewals have to be automatic. Nobody should be renewing a certificate by hand anymore.

Why it matters when you build a site

• Trust. A “Not secure” label next to your business name makes visitors hesitate, especially on a contact or checkout page.
• Data protection. Any page that collects names, emails or payment details should be encrypted.
• Moves and launches. When you point your domain at a new host or builder, the new platform has to issue a certificate for it. Expect a short window before the padlock appears, and launch at a quiet time.

Our guide to how a website works shows where the certificate fits alongside your domain, DNS and hosting.

How the big builders handle it

The plan details we track don’t list certificate features platform by platform, so check each help center for specifics. The general split looks like this:

• Hosted builders (Squarespace, Wix, Webflow, Framer, Shopify, WordPress.com): hosting is part of the plan and your site runs on their servers, so issuing and renewing the certificate is the platform’s job. After you connect a custom domain, confirm the site loads with https:// and a padlock.
• AI builders (Lovable, Bolt, v0): sites publish to the vendor’s hosting. Lovable’s newer apps run on Cloudflare Workers and v0 deploys to Vercel. If you move the code to your own host, the certificate becomes your job.
• Self-hosted WordPress: your host, or a service in front of it, supplies the certificate, very often a free Let’s Encrypt one. We build on WordPress every week, and after every launch we check that each page, image and script loads over HTTPS.

Common mistakes

• Paying for a certificate you don’t need. For most small business sites, a free domain-validated certificate gives the same encryption as a paid one. Paid types add identity checks on the company, not stronger encryption.
• Mixed content. If a page loads over HTTPS but an image or script still uses http://, the browser may warn visitors or block that file. This is common after a website migration.
• No redirect from HTTP to HTTPS. Visitors and old links that use http:// should be forwarded to the secure version automatically.
• Covering only one version of the domain. Make sure both www and the bare domain work over HTTPS.
• Relying on calendar reminders. With lifetimes heading to 47 days, manual renewal will fail sooner or later. Use a host or service that renews automatically.

Related terms

• Domain name: the address the certificate is issued for.
• Web hosting: the server that presents the certificate.
• CDN: a network that can also handle HTTPS in front of your host.
• Website migration: when certificate problems most often show up.