What Is an SSL Certificate and How Does It Work?

An SSL certificate is a small data file that links a website's domain name to a cryptographic key, signed by a certificate authority (CA): an organization that browsers trust to check who controls a domain. When you open a site over HTTPS, your browser uses the certificate to confirm that it has reached the real site, and then sets up an encrypted connection with it.

The name is a leftover. Connections today use TLS (Transport Layer Security), the successor of SSL (Secure Sockets Layer), so an "SSL certificate" and a "TLS certificate" are the same thing.

What's inside an SSL certificate?

A certificate is a public document: it holds no secrets, and anyone who visits the site can read it. It contains:

• The names it covers: one or more domain names, such as example.com and www.example.com, in a field called the Subject Alternative Name (SAN).
• A public key: one half of a key pair. The other half, the private key, stays on your server, and you never need to send it to anyone, not even to the CA.
• The issuer: the CA that checked the request and signed the certificate.
• The validity period: the dates it is valid from and until.
• On OV and EV certificates, the verified name of the organization behind the site.

The CA's signature is what makes it trustworthy: browsers and operating systems trust a list of root certificates, and accept a site's certificate only if its signatures lead back to one of them, usually through an intermediate certificate.

SSL or TLS: what's the difference?

SSL was the protocol behind the first HTTPS connections in the 1990s. Its last version, SSL 3.0, is no longer secure: in June 2015, the Internet Engineering Task Force (IETF), which publishes internet standards, required that it not be used (RFC 7568). TLS replaced it. TLS 1.0 and 1.1 were formally deprecated in March 2021 (RFC 8996), which leaves TLS 1.2, from 2008, and TLS 1.3, from 2018, in use today.

The certificate doesn't depend on the protocol version: the same certificate works with TLS 1.2 and TLS 1.3.

How HTTPS works, in plain terms

HTTPS is ordinary HTTP, the protocol that loads web pages, sent through a TLS connection. Each time your browser connects to a site, TLS does three things before any page is sent:

1. The server identifies itself. It sends its certificate, with the intermediate certificates that link it to a trusted root.
2. The browser checks the certificate. The signatures must lead back to a root it trusts, the certificate must cover the name in the address bar, and today's date must fall within its validity period.
3. The server proves it's genuine, and both sides agree on keys. The server signs the handshake with the private key that belongs to the certificate, which only the real site has. Browser and server then work out fresh encryption keys for this connection alone.

From then on, everything sent in both directions is encrypted and protected against tampering. Someone on the same Wi-Fi network, or anywhere between you and the server, can still see that you're connecting to the site, but can't read or change the pages, passwords or payment details you exchange.

What HTTPS doesn't do is vouch for the site. A certificate shows that you reached the domain in the address bar, not that the people behind it are honest. Google's Chrome team wrote in 2023 that nearly all phishing sites use HTTPS and that the padlock "does not indicate website trustworthiness", and announced that Chrome would replace the padlock with a neutral "tune" icon from Chrome 117, released in September 2023.

Does your website need an SSL certificate?

Yes. Every website does, including sites without logins or payments:

• Browsers warn about HTTP. Chrome marks plain HTTP pages as not secure. In October 2025, Google announced that with Chrome 154, due in October 2026, it would turn on Chrome's "Always Use Secure Connections" setting by default, so that Chrome asks for permission before it first opens any public site without HTTPS.
• Your visitors' data stays private. Without HTTPS, anyone on the network path can read and change what visitors send and receive, from contact forms to passwords.
• It's part of a good page experience. Google's page experience guidance asks whether your pages are "served in a secure fashion". It also says that, beyond Core Web Vitals, page experience aspects don't directly help a site rank higher. HTTPS keeps the connection to your site private and protected against tampering; it isn't a shortcut to better rankings.

Validation types: DV, OV and EV

Before a CA issues a certificate, it checks the request. The CA/Browser Forum, where certificate authorities and browser makers agree on the rules for publicly trusted certificates, sets how much is checked for each type in its Baseline Requirements:

• Domain Validated (DV): the CA checks only that you control the domain. For example, it asks you to place a file on the website, add a DNS record, or reply to an email sent to an address at the domain. The check can be fully automated, and the certificate contains no organization name.
• Organization Validated (OV): the CA also checks that the organization requesting the certificate exists, and puts its verified name in the certificate.
• Extended Validation (EV): the most thorough check of the organization, under the Forum's separate EV Guidelines.

Every type encrypts the connection in the same way, and the Baseline Requirements state that all of them "provide the same level of assurance" of the domain name. What differs is how much the certificate tells you about who runs the site. For most websites, DV is all they need; OV or EV is for organizations that want their verified name in the certificate, for example because a partner or a policy asks for it.

EV certificates used to show a green address bar with the company name. Browsers have dropped that: Safari made the change in 2018, and Chrome moved the EV details into its site information panel in Chrome 77, after its research found that the indicator "does not protect users as intended".

Single-domain, wildcard and multi-domain certificates

Certificates also differ in the names they cover. A certificate is valid only for the names listed in it, so it must cover every address your visitors use, such as both example.com and www.example.com.

• Single-domain: one domain name. Check whether the www version is included; if it isn't, you need it as a second name.
• Wildcard: a name starting with *., such as *.example.com, covers every subdomain at that one level, such as www.example.com and shop.example.com. It doesn't cover example.com itself or a deeper name such as dev.shop.example.com, because the wildcard can stand for only one label.
• Multi-domain (also called SAN or UCC): several different names in one certificate, such as example.com, example.net and example.org. Wildcard names can be in the list too, which certificate sellers call a multi-domain wildcard certificate.

PositiveSSL, Comodo and Sectigo

Many certificate searches name Comodo or PositiveSSL. Comodo CA announced on November 1, 2018 that it was rebranding as Sectigo, and Sectigo still sells certificates under the Comodo name. PositiveSSL is a Sectigo brand. Its range now includes DV, OV and EV certificates, and single-domain, wildcard and multi-domain ones. The Comodo certificates LyraHosting sells, DV and EV, are on our SSL certificates page.

A paid DV certificate, such as PositiveSSL DV, is checked the same way as a free one: by domain control alone. What you pay a commercial CA for is OV and EV checks, its support, and extras such as site seals, small badges you can show on your pages. A seal doesn't change the encryption.

How long is an SSL certificate valid?

Not long, and the maximum is getting shorter. The Baseline Requirements set the longest validity a publicly trusted TLS certificate may have by the date it is issued:

• Issued before March 15, 2026: up to 398 days;
• from March 15, 2026: up to 200 days, the limit today;
• from March 15, 2027: up to 100 days;
• from March 15, 2029: up to 47 days.

The Forum adopted this schedule in April 2025, with ballot SC-081v3. The same rules shorten how long a CA may reuse a domain check: from March 15, 2029, it must have checked domain control within the 10 days before it issues a certificate.

In practice, a certificate bought "for a year" now has to be replaced at least once within that year, and replacing certificates by hand doesn't scale. Automate renewals instead, for example with an ACME client: software that requests and renews certificates over ACME, the standard protocol that Let's Encrypt uses.

Free SSL certificates and Let's Encrypt

Let's Encrypt is a nonprofit certificate authority, run by the Internet Security Research Group (ISRG), that charges no fee for its certificates. They are DV certificates only: Let's Encrypt says it doesn't offer OV or EV, mainly because it can't automate those checks. Its certificates are trusted by most browsers and operating systems, can cover several names, and can include wildcard names, which have to be validated with a DNS record (the DNS-01 challenge).

An ACME client such as Certbot, which Let's Encrypt recommends starting with, requests the certificate, proves that you control the domain and renews it, with the private key generated on your own server. Let's Encrypt's lifetimes are getting shorter too:

• Today: 90 days by default, with 45-day and 6-day certificates for subscribers who choose them;
• from February 10, 2027: 64 days by default;
• from February 16, 2028: 45 days.

Let's Encrypt advises renewing at about two-thirds of a certificate's lifetime, or letting your client follow ACME Renewal Information (ARI), rather than renewing on a fixed schedule such as every 60 days.

How to check a site's certificate

In a browser: select the icon to the left of the web address. It opens the site's information panel, where the connection details lead to the certificate: the names it covers, the CA that issued it and the date it expires. A full-page "Your connection is not private" error means a problem with the site, the network or your device; on a site you run, an expired certificate or one that doesn't cover the name visitors use is a common cause.

On the command line: with OpenSSL 3.0 or newer, this command shows the same details for any HTTPS site. Replace example.com with the domain you want to check:

openssl s_client -connect example.com:443 </dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

The first part connects to the site and prints the certificate it sends; the second reads it. subject and subjectAltName show the names it covers, issuer the CA, and notBefore and notAfter the dates it's valid from and until.

SSL certificates at LyraHosting

• Offshore web hosting: free SSL certificates are included on both plans, SSD Starter and SSD Enterprise. You manage them in cPanel, together with your files, email and databases. Offshore web hosting starts at €5.99 a month.
• VPS and dedicated servers: you install and renew certificates yourself, with full root access on Linux or administrator access on a Windows VPS, for example free ones from Let's Encrypt with an ACME client, such as Certbot on Linux. A Linux VPS starts at €8.99 a month, and a dedicated server gives you a whole physical machine.
• Paid certificates: LyraHosting also sells Comodo (now Sectigo) DV and EV certificates, including wildcard and multi-domain ones. Compare them on our SSL certificates page.

Not sure which fits your site? Contact our team before you order. Technical support is by ticket, 24/7/365, with a first reply within 1 hour.