You open a site and find a small padlock next to the address, and you open another and a red page says your connection is not private. One technology called TLS, and one certificate that people call SSL even though its correct name has been TLS for more than twenty years, make the difference between the two cases. That confusion is the source of most of the questions: do I buy SSL or TLS? And why does my host say "free SSL" when the browser runs a different protocol?
In this guide we explain what SSL and TLS are from the roots, and we build each piece of information on three documented sources: the learning center and documentation of Cloudflare, the SSL Shopper site that specializes in explaining and comparing certificates, and the official documentation of the non-profit Let's Encrypt. We added what actually changed in 2026, because certificate lifetimes are shrinking by a binding industry decision, and that touches everyone who owns a site, blog or store. Where those sources do not cover a point (such as the deprecation of TLS 1.0, setup recommendations and the effect of HTTPS on Google), we went to the IETF, Mozilla and Google documents and say so where it applies.
After reading, you will know how the handshake between the browser and the server happens, what is inside a certificate, which type suits you, why you will most likely not pay a cent, and how to check your site's certificate and fix its most common errors yourself.
📋 Quick summary: SSL and TLS at a glance
| Item | Details |
|---|---|
| Definition | A protocol that encrypts the connection between the browser and the server, verifies the site's identity and detects any tampering with the data on the way |
| The correct name today | TLS (Transport Layer Security). The first version came out in 1999 to replace SSL |
| Latest version | TLS 1.3, published in 2018 |
| Versions accepted today | TLS 1.2 and TLS 1.3. TLS 1.0 and 1.1 have been formally deprecated by the IETF |
| The status of SSL itself | Developed by Netscape in 1995, and its last version was SSL 3.0. It is abandoned and has known vulnerabilities |
| What the visitor sees | https:// in the address and a padlock in the browser |
| What your site needs | A certificate (called SSL loosely, and really a TLS certificate) issued by a trusted certificate authority (CA) |
| Validation levels | DV, OV and EV. The encryption is the same in all three, and the difference is how far your identity is verified |
| Free certificates | Let's Encrypt (which says on its home page that it serves more than 700 million websites; I could not re-open the page in this pass) and Cloudflare (free certificates on every plan) |
| Default lifetime at Let's Encrypt | 90 days now, falling to 45 days by February 2028 |
| The industry maximum | 200 days since March 15, 2026, then 100 days in 2027 and 47 days in 2029 |
What are SSL and TLS? And why are there two names for one thing?
SSL stands for Secure Sockets Layer, an encryption protocol developed by Netscape in 1995 to achieve three things in internet connections: privacy, proof of the other party's identity and data integrity. Before it, data on the web traveled in plain text that anyone who intercepted it could read. Imagine you enter your card number in a store, and the number travels across dozens of machines exactly as it is, with no covering at all. SSL came to fix this flaw, so intercepted data became just scrambled characters with no meaning.
Why did the name change to TLS?
In 1999 the Internet Engineering Task Force (IETF) proposed an update to the protocol. Because the update came under the IETF's supervision and Netscape left the picture, the name changed to TLS. Interestingly, the first version, TLS 1.0, began development as SSL 3.1 before the name was changed ahead of publication, and the differences between it and SSL 3.0 were not radical. Changing the name was an announcement of a change of owner more than a technical revolution. SSL Shopper documents that TLS 1.0 was published as RFC 2246 in January 1999 as the direct successor to SSL 3.0.
Is SSL still used today?
No. The last version of SSL is 3.0 (released in 1996), which is obsolete and has known vulnerabilities, security experts advise stopping its use, and most modern browsers no longer support it at all. What runs behind every secured site today is TLS. So when you see a host offering "free SSL", it is most likely giving you TLS. The old name stayed on product pages because people still search for it, not because anyone runs a thirty-year-old protocol.
The technical difference between SSL and TLS: a comparison table
Someone searching for the difference between SSL and TLS usually wants a table. Here it is, with the note that the comparison is between SSL 3.0 (the last SSL version) and modern TLS versions:
| Point of comparison | SSL (last version 3.0) | TLS (1.2 and 1.3) |
|---|---|---|
| Developer | Netscape (1995) | The IETF (since 1999) |
| Message integrity check | An early form of message authentication code (MAC) | HMAC, and in TLS 1.3 the choices are limited to authenticated encryption (AEAD) |
| Encryption algorithms | Includes algorithms that are now dangerous to use, such as RC4 and DES | AES and ChaCha20 within short, safe lists |
| Forward secrecy | Not guaranteed | Supported in 1.2 and mandatory in 1.3, so old sessions stay protected even if the key leaks later |
| The handshake | Slower and more complex | Simpler, and in TLS 1.3 one round trip is enough |
| Status today | Abandoned, and not supported by most browsers | The accepted standard |
Four terms everyone mixes up
| Term | What it really is | Used today? |
|---|---|---|
| SSL | The original protocol from Netscape, last version 3.0 | No, abandoned |
| TLS | The successor the IETF issued from 1999, with 1.3 as its latest version | Yes, it is the standard |
| HTTPS | Ordinary HTTP with TLS encryption added. Any site that starts with https runs on TLS | Yes |
| SSL certificate | A file installed on the server that carries the domain's identity, the public key and the certificate authority's signature. Its technical name is a TLS certificate | Yes, and the popular name remains |
TLS is not limited to the browser. It is the same technology that encrypts email, messaging and calls over the internet, protects API calls and secures DNS queries over HTTPS. Any connection you want private usually goes through a TLS handshake.
Bluehost includes free SSL (Let's Encrypt) on its plans, with a free domain for the first year. The Starter plan is $3.79 a month on a 36-month term and renews at $9.99 (in some countries the prices show as $3.99, $6.99 and $14.99, or $143.64, $251.64 and $539.64 up front, as read on October 16, 2026; check the cart before you pay)
☑️ See Bluehost plans
How does TLS work? The handshake between the browser and the server
Every time you type an address that starts with https, something that takes a fraction of a second happens before the page appears: a process called the TLS handshake. It is what turns an exposed connection into an encrypted one.
Three functions, not one
Many people think TLS is only encryption. It really achieves three goals together:
- Encryption: hides the transmitted data from any third party intercepting the route.
- Authentication: makes sure both parties are who they claim to be, so a fake site cannot pass as your bank.
- Data integrity: detects any tampering or forgery in transit, because the data is signed with a message authentication code (MAC) that the receiver checks, like a wax seal on a letter that cannot be opened without showing.
The handshake step by step
The handshake starts after the browser opens an ordinary TCP connection to the server. According to Cloudflare's explanation, the simplified steps go like this:
- Client Hello: the browser sends the TLS versions it supports, a list of cipher suites it understands and a random string of bytes.
- Server Hello: the server replies with its certificate, the cipher suite it chose from the list and its own random string.
- Certificate check: the browser examines the certificate: is it unexpired, was it issued for this domain, and does its signature trace back to an authority it already trusts?
- Key agreement: the two sides reach a shared secret from which the session key is derived, either by encrypting a preliminary secret with the server's public key or through a Diffie-Hellman exchange in which each side works out the shared secret itself without it ever crossing the wire in the open.
- Finished messages: each side sends a message encrypted with the session key to say it is ready.
- Symmetric encryption: from here on all communication continues with the same session key.
Why this complicated order? Because encryption with a public and private key pair (asymmetric) is secure but heavier to compute, so it is used only at the start of the connection to agree on a secret session key. After that both sides continue with faster symmetric encryption. The public key is inside the certificate and everyone can see it, while the private key stays secret on the server, and what one key encrypts only the other can decrypt.
What changed in TLS 1.3?
TLS 1.3 removed everything considered weak: it no longer supports key exchange with RSA (which Cloudflare considers insecure today and which was used before 1.3), nor the cipher suites exposed to attacks. It shortened the list of options, so the browser guesses the server's preference and sends key information in the first message.
| Point of comparison | TLS 1.2 and earlier | TLS 1.3 |
|---|---|---|
| Handshake round trips | Two round trips | One round trip |
| RSA key exchange | Supported, and considered insecure today | Removed |
| Cipher suites | A long list that includes weak options | A short list of safe options only |
| A returning visitor | A shortened handshake through session resumption | Can reach zero round trips (0-RTT) |
The result is that TLS 1.3 is faster and more secure at the same time, a rare combination in a security world where safety usually comes at the cost of speed.
Does TLS slow my site down?
This was an old argument for postponing HTTPS. Today Cloudflare says the latest TLS versions hardly affect application performance. The reason is techniques that cut handshake time, including TLS False Start, which lets data start flowing before the handshake finishes, and session resumption, which gives a returning visitor a shortened handshake. The computing cost on the server has become tiny by today's standards. Anyone who postpones HTTPS for speed is holding on to an argument whose time has passed.
Which TLS versions are still accepted?
When your host asks you, or a security scan report asks you, to switch off old versions, this is the map:
| Version | Year | Status today |
|---|---|---|
| SSL 2.0 and 3.0 | 1995 and 1996 | Abandoned |
| TLS 1.0 | 1999 | Formally deprecated by the IETF (RFC 8996) |
| TLS 1.1 | 2006 | Formally deprecated by the IETF (RFC 8996) |
| TLS 1.2 | 2008 | Accepted and widespread, and the version the IETF has recommended for its protocols since 2008 |
| TLS 1.3 | 2018 | The newest and best, so turn it on whenever you can |
RFC 8996 explains the deprecation by saying that versions 1.0 and 1.1 do not support the current recommended cryptographic algorithms and mechanisms, and that many government and industry profiles now require avoiding them. In practical configuration, Mozilla's "Intermediate" profile, which suits most sites, recommends turning on TLS 1.2 and TLS 1.3 together and switching off SSLv2, SSLv3, TLS 1.0 and 1.1. TLS 1.3 alone (the "Modern" profile) suits anyone who does not need to support old browsers.
How do you check the TLS versions on your site?
From the terminal, try connecting with each version separately. If the connection succeeds, that version is turned on at the server:
openssl s_client -connect example.com:443 -servername example.com -tls1_3
openssl s_client -connect example.com:443 -servername example.com -tls1_2Also try -tls1_1 and expect it to fail; if it succeeds, the server needs an update. But note that some modern OpenSSL builds refuse old versions locally and do not show you the whole picture, so the free SSL Labs test is more accurate: it lists the versions and cipher suites enabled on your site.
The SSL/TLS certificate: your site's digital ID card
The certificate is a file you install on your site's origin server, and it works like an ID card: it proves that whoever the browser is talking to really is the owner of this site. Without it, TLS cannot be turned on at all.
What is inside a certificate?
A certificate carries the name of the domain it was issued for, the site's public key, the digital signature of the issuing authority and a fixed expiry date that nobody can exceed. You can see all of this yourself: click the padlock next to the address of any site, then choose to view the certificate, and you will find the issuing authority, the validity period and the domains it covers.
Who is the certificate authority (CA) and how is the chain of trust built?
A certificate authority is a party that checks the requester and then signs their certificate. SSL Shopper explains that these authorities keep detailed records of what they issued and the information they based their decision on, are audited periodically and publish a document called a Certification Practice Statement that explains the verification procedures.
But why does the browser trust an authority your site has never heard of? Because trust passes through signatures. Your site's (leaf) certificate is signed by an intermediate certificate, and the intermediate is signed by a root certificate stored in advance in the browser and the operating system. If one link in this chain breaks, a trust warning appears even though your certificate is fine. SSL Shopper notes that certificates from the major authorities it lists are compatible with about 99% of browsers.
What is a CSR and how does the private key relate to the certificate?
When you request a traditional certificate, a text file called a CSR (Certificate Signing Request) is created on the server. It holds data that goes into the certificate, such as the domain name, the organization name and the country, plus the public key. The private key is created at the same moment, so a key pair forms.
openssl req -new -newkey rsa:2048 -nodes -keyout example.key -out example.csrThe issuing authority needs the CSR and never needs your private key. And here is the most important rule: the certificate works only with the private key it was born with. If the private key is lost, the certificate is useless. According to SSL Shopper, keys shorter than 2048 bits are considered weak (its assessment dates from 2016), and most providers encourage 2048 bits in all certificates. To see what is inside the CSR you have:
openssl req -in example.csr -noout -textTypes of SSL certificate: by the number of domains and by validation level
Certificates are classified on two independent axes, and this is where many buyers go wrong. One axis sets what the certificate covers, and the other sets how closely the issuing authority checks your identity. For example, you can have a Wildcard certificate at DV level or at OV level.
The first axis: what does the certificate cover?
| Type | What it covers | Example |
|---|---|---|
| Single domain | One domain only and all its pages, but not its subdomains | example.com |
| Wildcard | One domain and all its subdomains in one certificate | *.example.com covers blog.example.com and mail.example.com |
| Multi-domain (SAN / UCC) | Several different, unrelated domains in one certificate | example.com and another-site.net |
SSL Shopper warns of a common trap here: if the certificate was issued for www.example.com and the visitor then goes to example.com without www, a name mismatch error appears because the address in the bar does not match the name written in the certificate. So make sure your certificate covers both the www version and the version without it.
The second axis: how closely does the issuing authority check?
| Level | What does the authority verify? | How? | Suits |
|---|---|---|---|
| DV (Domain Validation) | Only that you control the domain | Changing a DNS record or an email message, and usually automatic | Blogs, portfolios and small projects that do not sell directly through their site (such as a restaurant or café) |
| OV (Organization Validation) | That the organization exists. The authority contacts the requester and may check more, and the organization's details are written into the certificate | Manual review | Company sites that want a higher level of visitor trust |
| EV (Extended Validation) | A full check: the organization's existence, legal registration and physical address | The slowest and most expensive | Anyone who needs the highest level of identity verification |
What about a self-signed certificate?
It is a certificate the site owner issues for themselves and signs themselves instead of using a trusted issuing authority. It does encrypt the connection, but it carries no guarantee of identity, so the browser shows it with a security warning, because its chain does not end in a root the browser trusts (which is exactly the "certificate not trusted" error explained below). It suits test and development environments and internal services whose devices you control, and it does not suit a site the public visits.
GreenGeeks lists free SSL on its shared plans. Lite is $2.95 a month on a 12-month prepayment and renews at $13.95, so check the renewal price before you buy
☑️ See GreenGeeks plans
Let's Encrypt: how did the free certificate become the rule?
Let's Encrypt is a global non-profit certificate authority run by the Internet Security Research Group (ISRG). It offers free, automated and open TLS certificates, and says on its home page that it serves more than 700 million websites. Its stated goal is to make HTTPS available to anyone who has a domain, in the simplest way possible.
The six principles it stands on
The organization says it is free for anyone who owns a domain, automatic because server software handles issuing and renewal without your involvement, secure and pushing TLS best practice forward, transparent so that every certificate issued or revoked is publicly recorded, open because the issuing and renewal protocol (ACME) is a published standard anyone can adopt, and cooperative, not controlled by any single party.
What does Let's Encrypt offer and what does it not?
| Aspect | The situation according to its official documentation |
|---|---|
| Validation level | DV only. No OV or EV and no plans for them, because it cannot automate issuing them |
| Wildcard | Available, but issuing is through the DNS-01 challenge only |
| Several names (SAN) | Available in one certificate |
| Use | Any server with a domain name: web, mail and FTP. But it does not issue email encryption or code-signing certificates |
| The private key | Always created and managed on your server. It does not create or store it |
| Technical support | No direct support for subscribers. The official documentation and the community forum are the reference |
| Cost | No fee for the certificates themselves, though some hosting providers may charge a small fee to manage them |
| Trust | Trusted by most browsers and operating systems |
Who stands behind it? And why does it matter to you?
Hosting companies and site builders support Let's Encrypt (its sponsors page lists hosts and builders, though I could not re-open the current list in this pass). That explains why you will probably not type a single command: many hosts and website builders turn the certificate on and renew it for you automatically. The certificate is there, and you do not see it, until a renewal breaks.
⏳ Certificate lifetimes are shrinking: what changes from 2026 to 2029?
This is the most important change touching certificates in years, and you will feel it if you run your own server. The decision comes from the CA/Browser Forum (ballot SC-081v3), which certificate authorities and the major browser makers voted on. It cuts the maximum lifetime of any public certificate in three stages: from 398 days to 200 days from March 15, 2026, then 100 days on March 15, 2027, then 47 days on March 15, 2029. Let's Encrypt confirms the last limit in its documentation and says it will cut the lifetime of its certificates to 45 days by February 2028.
| Date | Industry maximum (CA/B Forum) | Let's Encrypt (default) |
|---|---|---|
| Before March 15, 2026 | 398 days | 90 days |
| March 15, 2026 | 200 days | 90 days (no change) |
| May 13, 2026 | No change | The optional tlsserver profile issues 45-day certificates for those who turn it on |
| February 10, 2027 | No change | 64 days (the default classic profile) |
| March 15, 2027 | 100 days | 64 days |
| February 16, 2028 | No change | 45 days |
| March 15, 2029 | 47 days | 45 days |
Let's Encrypt's short-lived certificates (six days) also stay available as an option for all subscribers. The changes apply to new certificates only, so the user only sees the shorter period at the first renewal after each date. Certificates issued before March 15, 2026 kept their original lifetime.
Why are they doing this?
It is not about anyone's mood. A shorter certificate means a narrower window of damage if its private key leaks, and it makes revocation more effective. Let's Encrypt explains that it picked 90 days at its launch in 2015 because that was short enough to encourage automation and long enough that manual renewal was possible. Today automation is widespread and its tools are mature, so it is comfortable with shorter periods. Along with this, the period for reusing domain-ownership validation falls from 30 days to 7 hours by 2028.
What should you do, depending on your situation?
If you are on shared web hosting, the provider usually handles renewal and you will not touch anything. Just make sure the certificate really does renew. If you run a VPS or a dedicated server yourself, check your renewal schedule now. And if your certificate is paid, know that the yearly subscription no longer means one file valid for a full year. SSL.com, for example, says that since March 2026 it issues certificates with a 198-day lifetime, while billing stays tied to your yearly license.
Choose hosting that turns on SSL and renews it automatically. Hostinger lists free SSL on its plans, a 30-day money-back guarantee and all plans paid upfront, with Premium at $2.99 a month on a 48-month prepayment (renewing at $10.99)
☑️ See Hostinger plans
What do SSL and TLS really mean for your site?
Trust: what your visitor sees before reading a word
Cloudflare notes that Chrome gradually tightened its treatment of sites not secured with HTTPS and other browsers followed, and that the ordinary user now gets wary of any site without the HTTPS padlock. It also warns on its product page that an expired certificate exposes a site to browser security warnings and a drop in search engines. That means a simple renewal mistake can cost you your visitors before it costs you your ranking.
Does HTTPS raise your ranking on Google?
In August 2014 Google announced that it had started using HTTPS as a ranking signal, describing it then as a very light signal affecting fewer than 1% of queries and weighing less than content quality. Today HTTPS falls among the page experience signals in Google's documentation, and Search Console has a separate HTTPS report that shows the pages not served over it and the reasons, such as an invalid certificate or a wrong redirect.
The honest summary: HTTPS will not move you from page five to page one, but its absence is a flaw that costs you visitors' trust and puts you in a weaker position. Google has not said that the type of certificate, free or EV, changes this signal.
Protection from snooping and injection
SSL Shopper explains that SSL prevents attackers and meddling companies, including internet providers, from tampering with data exchanged between your site and your visitors' browsers. And it does not protect payment cards only. It also protects your site from malware injected into the data path and stops others from injecting ads into your pages.
Do not confuse the padlock with safety
This is the most important caveat in the article. A DV certificate proves only that the requester controls the domain, and anyone who owns a domain can get one, including someone building a phishing site. That is why Let's Encrypt advises in its FAQ reporting phishing and malware sites that use its certificates to Google Safe Browsing and Microsoft SmartScreen, which are better placed to protect users. The padlock tells you: your connection to this domain is encrypted. It does not tell you: the owner of this domain is honest.
SSL with Cloudflare: two certificates instead of one
When you put Cloudflare between your visitor and your server, the shape of the connection changes. Cloudflare's documentation explains that one request may involve two certificates, not one: the Edge Certificate, which the visitor sees when connecting to Cloudflare, and the Origin Certificate, which secures the connection between Cloudflare and your origin server. The SSL/TLS encryption modes in the Cloudflare dashboard decide whether both certificates are used and how.
The certificates Cloudflare issues itself (Universal and Advanced) are at DV level, and the company says free SSL is included in every plan and that it works with certificate authorities to make sure they always renew. But its learning center notes that a site may also need a certificate on the origin server.
🔧 The best-known SSL certificate errors and how to fix them
Most of what you will actually see falls in four boxes. This is a summary according to the errors page at SSL Shopper:
| Error | Cause | Fix |
|---|---|---|
| Certificate not trusted | The certificate is not signed by a trusted root, or cannot be linked to one. Often an intermediate certificate in the chain was not installed on the server | Install the chain certificates following the issuing authority's instructions, and check the certificate path from its details in the browser |
| Name mismatch | The name inside the certificate does not match the address in the browser bar, such as visiting without www on a certificate issued with www | Issue a certificate that covers both versions, or redirect one to the other |
| Mixed content | An https page loads images, scripts or frames over http | Search for http:// in the page and replace it with https://, or use relative paths for files on the same domain |
| Expired certificate | Every certificate has a fixed expiry date and was not renewed before it | Renew at once, then turn on automatic renewal and an alert before expiry |
To diagnose the situation before a visitor complains, use the SSL Checker from SSL Shopper. You enter your site's name and it checks: is the certificate installed, does the server present the right intermediate certificates, what is its expiry date, is the right hostname listed in it, plus other problems such as old hash functions. The tool itself advises checking SSL Labs for anyone who wants a deeper report on protocols and cipher suites.
✅ Practical steps: check your site's SSL and turn it on
If your site is up, or about to launch, here is a practical seven-step sequence:
openssl s_client -connect example.com:443 -servername example.comIf you buy a paid certificate: the manual installation cycle
The free automatic certificate does not need this cycle, but anyone who buys a DV, OV or EV certificate from a commercial authority goes through all of it:
- Create a CSR and a private key on the server (the command is above) and keep the key completely secret.
- Submit the CSR to the issuing authority during purchase and complete the required validation: a DNS record change or an email message for DV certificates, and a manual review of the organization's identity for OV and EV, which is why their issuing takes longer.
- Download the certificate file with the authority's intermediate bundle (CA Bundle).
- Install it on the server with the matching private key, either from the SSL interface in the hosting panel or in the Apache, Nginx and IIS settings. And remember that the certificate does not work without the key it was born with.
- Check the installation with the SSL Checker tool and make sure the chain is complete, then set an alert to reissue before the new, shorter periods.
When is a free DV enough, and when should you consider a paid certificate?
✅ A free DV is enough if:
- Your site is a blog, a portfolio or a brochure site for a small business
- You do not sell products directly through your site (such as a restaurant or café)
- You want automatic issuing and renewal without your involvement
- Proof that the site belongs to the owner of this domain is enough for you
⚠️ Consider OV or EV if:
- You want the certificate to carry your organization's name and address (they appear when you click the padlock, not in the address bar)
- Your customers or your employer require institutional identity verification
- You need a certificate for email encryption or code signing, which Let's Encrypt does not issue
- You want an issuing authority that provides direct support, which Let's Encrypt does not
Remember that neither option gives you stronger encryption. According to Cloudflare, DV suits blogs, portfolios and small projects that want to launch HTTPS quickly, especially if they do not sell through their site.
Namecheap sells domains, SSL certificates (from $5.99 a year on its page on October 12, 2026) and hosting, and its Stellar plan starts at $2.28 a month for the first 12 months
☑️ Browse Namecheap offers
🏆 The final verdict: what do you do after this article?
The direct answer: do not pay for SSL unless you need your organization verified. The encryption is the same, the free one covers most cases, and the most dangerous thing about certificates today is not weak encryption but forgetting to renew. And with the maximum lifetime reaching 47 days in 2029, forgetting will cost even more than it does now. And do not pay for a green bar that some sellers promote; it disappeared from Chrome and Firefox in 2019.
If you are launching a blog or a small site, choose hosting that turns on the certificate and renews it for you, as in the Bluehost review or the Hostinger review. If you run your own server, install Certbot and watch for errors. If you need an OV certificate with a domain from one provider, see the Namecheap review, and if you run several sites, read the Cloudways review. If you have not chosen your hosting yet, compare in the best web hosting guide before any decision. In every case, before you pay for SSL as an add-on in the shopping cart, ask the provider whether the free certificate is already included.
Cloudways is managed cloud hosting suited to owners of several sites, and it lists free Let's Encrypt SSL. Plans start at $14 a month, with a 3-day free trial
☑️ Try Cloudways now
✅ SSL and TLS FAQ
❓ What is the difference between SSL and TLS?
❓ Is SSL still safe?
❓ Is a free Let's Encrypt certificate safe and enough?
❓ What is the difference between DV, OV and EV certificates?
❓ Does a paid certificate encrypt more strongly than a free one?
❓ How long is an SSL certificate valid?
❓ Is one certificate enough for my site and its subdomains?
*.example.com, which covers the domain and all its subdomains. At Let's Encrypt, Wildcard certificates are available only through the DNS-01 challenge.❓ What happens if the certificate expires?
❓ Does HTTPS mean the site is trustworthy and safe?
❓ Does TLS slow my site down?
❓ Why did strange visits to my site increase after I issued a certificate?
❓ Does Let's Encrypt keep my private key?
❓ Does my small blog with no store need SSL?
❓ Does HTTPS use the SSL or the TLS protocol? And do I need both?
❓ How do I know my site uses SSL/TLS?
❓ How long does a new certificate take to become active?
❓ What is a self-signed certificate? And when does it work?
❓ Does an EV certificate show my company name in the address bar?
❓ Does HTTPS raise my site's ranking on Google?
InterServer's standard shared plan lists SSL, a free Cloudflare CDN and a $7 a month renewal, and it also sells VPS plans from $3 a slice for those who want room to grow
☑️ See InterServer's offer
Related Articles
🌐 What is DNS and how does it work?
DNS records are the path DV certificates use to prove domain ownership, so understand them first.
📛 What is a domain and how do you choose one?
Every certificate is issued for a domain name, and this explanation shows what you buy and what you register.
☁️ What is Cloudflare?
The service that puts the edge certificate between your visitor and your server and offers free SSL.
🖥️ What is web hosting?
Where your site lives, and who is responsible for installing and renewing the certificate.
📋 Bluehost hosting review
A detailed review of a host that includes free SSL and automatic WordPress installation.
🌱 GreenGeeks hosting review
Eco-friendly hosting that lists free SSL on its shared plans.
📚 The sources this article is built on
I reviewed these pages on October 10, 2026 (the Let's Encrypt and CA/B Forum details), and wrote the information in my own words. Check them directly if you want to go deeper, because some details change over time. The three main sources first:
- Cloudflare Learning Center: What is SSL?
- Cloudflare Learning Center: What is TLS?
- Cloudflare Learning Center: What happens in a TLS handshake?
- Cloudflare Learning Center: Types of SSL certificates
- Cloudflare Docs: SSL/TLS concepts
- SSL Shopper: What is SSL?
- SSL Shopper: What is a CSR?
- SSL Shopper: SSL Certificate Errors
- SSL Shopper: SSL Checker
- Let's Encrypt: About
- Let's Encrypt: FAQ
- Let's Encrypt: Certificate Lifetime Rationale and Plans
- Let's Encrypt: Decreasing Certificate Lifetimes to 45 Days
- SSL.com: SSL Certificate Validity Changes (the CA/Browser Forum SC-081v3 schedule)
And supplementary sources for points the main sources did not cover:
- IETF: RFC 8996, deprecating TLS 1.0 and TLS 1.1
- Mozilla: Server Side TLS (the Modern and Intermediate profiles)
- Google Search Central: the HTTPS report in Search Console and page experience signals
- Search Engine Journal: HTTPS as a ranking factor
- BleepingComputer: removing the EV indicator from Chrome and Firefox
- cPanel Docs: installing an SSL certificate and the AutoSSL feature
- SSL Labs: check your SSL/TLS setup
Did this guide help? Share it with anyone who owns a site. And if you have a question about your site's certificate, write it in the comments below.
