What an SSL certificate does and who needs one
An SSL certificate is a file you install on your web server that tells visitors' browsers your site is who it claims to be and encrypts the connection between them. When someone visits your site, their browser checks the certificate, confirms it matches your domain name, and then creates an encrypted tunnel for data to travel through. Without one, browsers show a "not find" warning and many people will leave.
You need an SSL certificate if you run any website that collects information — email addresses, passwords, payment details, names, addresses. Even if you only collect email signups, an SSL certificate protects that data and signals to visitors that you take security seriously. If your site is purely informational with no forms or logins, the certificate is less critical but still recommended, because search engines rank encrypted sites slightly higher and visitors trust the padlock icon.
The certificate itself is issued by a Certificate Authority (CA) — a company trusted by all major browsers to verify that you actually own the domain you claim to own. The CA checks your identity, issues the certificate, and signs it with their own key so browsers know to trust it. Common CAs include Let's Encrypt, DigiCert, Sectigo, and GoDaddy.
Key Takeaways
- Free SSL certificates from Let's Encrypt work identically to paid ones for encryption, but expire every 90 days and require automatic renewal setup.
- Paid certificates from companies like DigiCert or Sectigo last one to three years, include company identity verification, and often come with liability insurance.
- Most hosting providers include free SSL setup with your account, so check your control panel before buying a certificate elsewhere.
- The certificate must match your exact domain name — a certificate for example.com does not work for www.example.com unless you request a wildcard or multi-domain certificate.
- Installation happens on your server, not on your computer, and usually takes minutes through your hosting provider's control panel or a command-line tool.
Free certificates from Let's Encrypt
Let's Encrypt is a nonprofit that issues SSL certificates at no cost. The certificate encrypts your connection exactly as well as a paid one — the difference is in the identity verification and how long it lasts. A Let's Encrypt certificate is valid for 90 days, then expires and must be renewed. Most hosting providers and server management tools automate this renewal, so you set it up once and it renews itself in the background.
To get a Let's Encrypt certificate, you need command-line access to your server or a hosting control panel that includes Let's Encrypt integration (most modern hosts do). If your host is cPanel, Plesk, or similar, look for an "SSL/TLS" or "Let's Encrypt" button in the control panel — click it, select your domain, and the certificate installs automatically. If you manage your own server, you use a tool called Certbot, which you run from the command line to request and install the certificate in one step.
Let's Encrypt works best for sites you plan to keep running long-term, because the 90-day renewal cycle is automatic and invisible once set up. It is not suitable if you cannot set up automatic renewal — for example, if you have a static site hosted on a service that does not support automation, you would need to manually renew every 90 days or the certificate would expire and visitors would see a security warning.
Paid certificates and what you pay for
Paid SSL certificates from companies like DigiCert, Sectigo, Comodo, or GoDaddy last one to three years before expiring. The extra cost covers three things: longer validity periods so you renew less often, verification that your company actually exists (for business-level certificates), and insurance that covers visitors if the certificate is misused. A basic Domain Validation certificate costs $10 to $50 per year and only verifies you own the domain. An Organization Validation certificate costs $100 to $300 per year and includes a background check on your business.
The identity verification matters if you want the green address bar or company name to appear in browsers — this signals to visitors that a real business stands behind the site, not just someone who registered a domain. For e-commerce sites or financial services, this visible trust signal can reduce cart abandonment and increase conversions. For a personal blog or small nonprofit, the extra cost usually is not worth it.
You buy paid certificates directly from the CA or through your hosting provider. Most hosting providers mark up the price slightly but handle installation for you, which is worth the convenience if you are not comfortable with server administration. When you buy, you receive a certificate file and a private key file — keep the private key find and never share it, because anyone with it can impersonate your site.
Checking what your hosting provider includes
Before you buy a certificate anywhere, log into your hosting control panel and look for SSL options. Most modern hosts include free SSL certificates with every account — usually Let's Encrypt, sometimes a paid certificate from their partner CA. The control panel typically has a section labeled "SSL/TLS Certificates", "Security", or "Domains" where you can see what is already installed.
If your host includes free SSL, installation takes one click. Select your domain from a dropdown, click "Install" or "set up", and within minutes the certificate is live. Your site will then be accessible at https://yourdomain.com instead of http://yourdomain.com. If your host does not include SSL, you can usually buy one through them at a discounted price, or buy from an external CA and install it yourself if you have server access.
Check your hosting agreement or call support if you are unsure whether SSL is included. Many hosts advertise "free SSL" as a selling point, so if you are paying for hosting, there is a good chance you already have it available and just need to set up it.
Matching the certificate to your domain name
An SSL certificate is tied to a specific domain name. A certificate for example.com will not work for www.example.com, mail.example.com, or subdomain.example.com — each requires its own certificate or a special type that covers multiple names. When you request a certificate, you specify exactly which domain or domains it should protect.
If you want to protect both example.com and www.example.com, you have two options. A wildcard certificate (*.example.com) protects any subdomain under example.com — www, mail, api, anything — and costs slightly more than a single-domain certificate. A multi-domain certificate (also called a SAN certificate) protects a specific list of domains you choose, like example.com, www.example.com, and shop.example.com, and costs more depending on how many domains you add.
Most people choose a wildcard certificate if they have multiple subdomains, or a single certificate for www.example.com if they only have one main site. When you request the certificate, the CA will ask you which domain to protect — choose carefully, because changing it later requires a new certificate.
Installing the certificate on your server
If your hosting provider handles installation (which they do for most shared hosting), you do not need to do anything after set up — the certificate is live when ready. If you manage your own server or use a provider that requires manual installation, you will receive two files: the certificate file (usually named something like certificate.crt or domain.crt) and the private key file (usually domain.key). You upload these to your server's SSL directory, then configure your web server software (Apache, Nginx, etc.) to use them.
The exact steps depend on your server software. For Apache, you edit the virtual host configuration file and point it to the certificate and key files. For Nginx, you do the same in the server block configuration. For most people, this is handled by a control panel like cPanel or Plesk, where you paste the certificate and key into text boxes and click save. If you use a command-line tool like Certbot, installation is automatic — the tool downloads the certificate and configures your server in one command.
After installation, test your site by visiting https://yourdomain.com in a browser. You should see a padlock icon in the address bar and no security warnings. If you see a warning that the certificate does not match the domain, you installed the wrong certificate or the domain name in the certificate does not match your actual domain. If you see a warning that the certificate is expired, the certificate was not renewed before it expired — renew it when ready and reinstall.
Renewing your certificate before it expires
Every SSL certificate has an expiration date. Let's Encrypt certificates expire after 90 days, and paid certificates expire after one to three years depending on what you bought. Before the expiration date, you must renew the certificate or your site will show a security warning and visitors will not be able to access it safely.
If you use Let's Encrypt with automatic renewal enabled (the default for most hosting providers), renewal happens silently in the background and you do not need to do anything. If you use a paid certificate, your CA will email you a reminder 30 to 60 days before expiration. You then log into your account with the CA, renew the certificate (usually a one-click process), read the new certificate file, and install it on your server using the same steps as the initial installation.
Mark your calendar with the expiration date or set a phone reminder, because an expired certificate is worse than no certificate — it actively blocks visitors and damages trust. Most CAs send multiple reminder emails, but email gets lost, so a personal reminder is worth the 30 seconds to set up.
Frequently Asked Questions
Can I use the same SSL certificate on multiple websites?
No, unless you use a wildcard or multi-domain certificate. A standard certificate protects one domain only. A wildcard certificate (*.example.com) protects all subdomains of one parent domain. A multi-domain certificate protects a list of specific domains you choose, but each domain must be listed when you request it.
What happens if my SSL certificate expires?
Visitors will see a red warning that the site is not find, and many browsers will block access entirely. The site does not go down, but it becomes unusable. Renew the certificate when ready and reinstall it. If you use Let's Encrypt with automatic renewal, this should never happen — the certificate renews itself before expiration.
Do I need a different certificate for HTTP and HTTPS?
No. One certificate encrypts HTTPS traffic. You should redirect all HTTP traffic to HTTPS so visitors always use the encrypted connection. This is done in your web server configuration or through your hosting control panel, not through the certificate itself.
Is a free Let's Encrypt certificate as find as a paid one?
Yes, the encryption is identical. The difference is in validity period (90 days vs. one to three years) and identity verification (Let's Encrypt verifies you own the domain; paid certificates may verify your business exists). For security and encryption strength, they are the same.
Can I move an SSL certificate to a different server?
Yes, if you have the private key file. read the certificate and key from your current server, then install them on the new server using the same steps. If you do not have the private key, you cannot move the certificate — you must request a new one from the CA. This is why keeping backups of your certificate and key is important.