What is an SSL certificate and how does it work?

The padlock that appears in a browser's address bar is one of the most recognized symbols on the web. An SSL certificate is what puts it there, and what it actually does goes further than most visitors realize. It determines whether data sent through your site travels encrypted or in plain text readable to anyone intercepting the connection. Understanding how SSL works, and where it falls short, changes how you approach protecting your visitors.

SSL is the underlying technology that makes HTTPS possible. When a visitor's browser connects to a website with a valid SSL certificate, it establishes an encrypted connection before any data is exchanged. The padlock icon, the HTTPS prefix in the address bar, and the absence of a "Not secure" browser warning are all produced by that certificate being present and valid. For context on why security matters across your whole website, see the article on why website security is important.

What does an SSL certificate actually do?

An SSL certificate performs two distinct functions at the same time. It encrypts data in transit and it authenticates the website's identity.

Encryption

• Encryption means that any data sent between the browser and the server is scrambled into unreadable form during transmission
• Only the intended recipient, either the browser or the server, holds the key to unscramble it
• Without encryption, form submissions, login credentials, and payment details travel across networks as plain text that can be read if intercepted

Authentication

• An SSL certificate is issued by a certificate authority, an independent organization that verifies a website's identity before issuing the certificate
• This verification process confirms that the domain the certificate covers is controlled by the organization claiming to own it
• When a browser checks the certificate, it confirms both that the connection is encrypted and that the site is the one it claims to be, not an impersonator

How does SSL encryption work?

The encryption process happens automatically and invisibly at the moment a browser connects to a website. It involves a sequence of steps called the TLS handshake. TLS, or Transport Layer Security, is the modern name for the protocol originally called SSL.

The connection sequence

• The browser requests a secure connection and the server responds by sending its SSL certificate
• The browser verifies the certificate with the certificate authority that issued it, confirming it is valid and has not expired
• Both sides agree on an encryption method and exchange keys, establishing a secure channel
• All data transmitted after this point is encrypted for the duration of the session

What the encryption protects

• Contact form data, including names, email addresses, and messages
• Login credentials, including usernames and passwords
• Payment card details and billing information
• Any other input a visitor submits through your website

What SSL does not protect

• SSL encrypts data in transit. It does not protect data that is stored insecurely on the server after it has been received
• A website with an SSL certificate can still be hacked if the server itself has security vulnerabilities
• SSL is one layer of website security, not a complete solution on its own

What are the different types of SSL certificates?

SSL certificates vary by the level of identity verification the certificate authority performs before issuing them.

Domain validation

• The certificate authority confirms only that the applicant controls the domain
• The process is automated and certificates are issued quickly
• Domain validation certificates are sufficient for blogs, informational websites, and most websites that do not process payments directly on-site

Organization validation

• The certificate authority verifies both the domain and the legal existence of the organization applying for the certificate
• Organization validation certificates are more commonly used by businesses that want to display verified organization information alongside the certificate

Extended validation

• Extended validation certificates involve the most thorough identity verification process, including legal, physical, and operational checks on the organization
• They were historically associated with a green address bar in browsers, though this visual distinction has been removed in modern browsers
• Extended validation certificates are typically used by financial institutions and large e-commerce platforms

Wildcard and multi-domain certificates

• A wildcard certificate covers a domain and all of its subdomains under a single certificate
• A multi-domain certificate covers multiple separate domains under one certificate
• These are practical for organizations managing multiple sites or subdomains without issuing a separate certificate for each

Do all websites need an SSL certificate?

Yes. The need for HTTPS is not limited to websites that take payments or handle sensitive data. It applies to every publicly accessible website for three reasons.

Browser warnings

• Browsers display a "Not secure" label in the address bar for any website served over HTTP
• For pages with forms, some browsers show an explicit warning before a visitor submits anything
• These warnings reduce trust and discourage visitors from interacting with the page

Search ranking

• HTTPS is a confirmed ranking signal. Sites served over HTTPS have a ranking advantage over equivalent pages served over HTTP
• Search engines also reduce the visibility of sites with active security warnings in results

Visitor data protection

• Even a website that only has a contact form is collecting visitor data. Without HTTPS, that data is transmitted without encryption
• In many regions, data protection regulations require that personal data be handled securely, which includes protecting it during transmission

How do you get an SSL certificate?

Through your hosting provider

• Many website hosting providers include SSL certificates as part of their hosting packages
• In these cases, the certificate is installed and renewed automatically without any action from the site owner
• This is the simplest option for most websites

Through a certificate authority

• SSL certificates can be obtained directly from certificate authorities and installed on a server manually
• Free certificates are available from widely trusted certificate authorities and are renewed automatically using verification tools
• This option requires more technical knowledge and is more common for development teams managing their own servers

After obtaining the certificate

• Once a certificate is installed, all internal links and asset references on the site should point to HTTPS URLs to avoid mixed content warnings
• A redirect from HTTP to HTTPS should be configured so that visitors who reach the HTTP version are automatically sent to the secure version

For a complete explanation of what HTTPS means and how it affects your visitors and rankings, see the article on what HTTPS is and how it protects your website. For a full guide on protecting your website beyond the certificate itself, see the article on how to protect your website from hackers. For guidance on website backups as a complementary security measure, see the article on how to back up your website.

How WEMASY handles SSL certificates

SSL certificates are included on every WEMASY plan. When a website is created on the WEMASY platform, the certificate is installed and activated automatically. All pages are served over HTTPS by default without any setup required from the site owner.

Certificates are renewed automatically before they expire. There is no manual renewal process and no risk of the certificate lapsing and triggering browser warnings. The underlying SSL infrastructure is maintained at the platform level, so site owners do not need to manage it directly.

See what is included at the WEMASY website builder, or review plan options on the pricing page.

Frequently asked questions