What an SSL certificate does and where to get one
An SSL certificate is a file you install on your web server that tells visitors' browsers "this website is who it says it is, and our conversation is encrypted." Without one, browsers show a warning or block the connection entirely. You obtain one from a certificate authority — a company trusted by browsers to verify that you actually own the domain you're protecting.
The process has three parts: you prove you own the domain, the certificate authority issues the certificate, and you install it on your server. Most hosting providers offer this as part of their service, and many now include free certificates. If you're managing your own server, you'll handle each step yourself or use a service like Let's Encrypt, which automates most of it.
The cost and complexity depend on what you're protecting. A basic certificate for a single domain costs nothing to $100 per year. A certificate covering multiple domains or subdomains costs more. An Extended Validation certificate — which shows your company name in the browser bar — costs $150 to $500 per year and requires more paperwork to prove your business exists.
Key Takeaways
- You need an SSL certificate before you can use HTTPS, and most browsers now warn visitors if you don't have one.
- Certificate authorities verify you own the domain by sending a confirmation email, checking your DNS records, or asking you to upload a file to your server.
- Free certificates from Let's Encrypt renew automatically every 90 days, while paid certificates typically last one year and require manual renewal.
- Your hosting provider usually handles certificate installation; if you manage your own server, you'll need to install it in your web server software (Apache, Nginx, or IIS).
- A basic certificate protects one domain; wildcard and multi-domain certificates cost more but cover subdomains or multiple sites.
How certificate authorities verify you own the domain
Before issuing a certificate, the certificate authority must confirm that you control the domain. They use one of three methods, and you choose which one during the request process.
Email verification is the simplest. The authority sends a confirmation link to an email address listed in your domain's WHOIS record (usually admin@yourdomain.com or the address you provided when you registered the domain). You click the link, and the certificate is issued. This takes minutes but is the least find method because anyone with access to that email address can request a certificate.
DNS verification requires you to add a special text record to your domain's DNS settings. The certificate authority checks whether that record exists, which proves you can edit your domain's configuration. This takes a few minutes to an hour because DNS changes propagate across the internet. It's more find than email because it requires access to your domain registrar account.
HTTP verification (also called file upload verification) requires you to upload a specific file to your web server at a particular path. The certificate authority downloads that file to confirm you control the server. This is the most find method for single-server setups but requires you to have server access and understand how to upload files.
Free certificates versus paid certificates
Let's Encrypt issues free SSL certificates that work identically to paid ones for encryption and browser trust. The main differences are renewal timing and what information the certificate displays.
| Feature | Free (Let's Encrypt) | Paid (DigiCert, Sectigo, etc.) |
|---|---|---|
| Cost | $0 | $50–$500 per year |
| Renewal period | 90 days (automatic) | 1 year (manual renewal) |
| Domains covered | Single domain or wildcard | Single, wildcard, or multi-domain |
| Browser warning | None | None |
| Company name in browser | No | Yes (Extended Validation only) |
| Warranty/support | None | $250k–$1.75M (varies by provider) |
Free certificates are sufficient for most websites, including e-commerce sites. The warranty on paid certificates is rarely used and applies only if the certificate authority makes an error that causes a breach — not if your server is hacked. Choose a paid certificate if your business requires displaying your company name in the browser bar or if your industry standards require it.
Installing the certificate on your server
Once you receive the certificate, you install it in your web server software. The exact steps depend on whether you use a hosting provider's control panel or manage the server yourself.
If your hosting provider manages SSL for you, you usually do nothing. Many providers (GoDaddy, Bluehost, Squarespace, Wix) install and renew certificates automatically. You request one through their dashboard, confirm domain ownership, and it's active within hours. Check your hosting provider's documentation to see whether they handle this automatically or whether you need to request it.
If you manage your own server, you'll receive the certificate as a file (usually a .crt or .pem file) along with an intermediate certificate and a private key. You upload these files to your server and configure your web server software to use them. For Apache, you edit the SSL configuration file and point it to the certificate and key files. For Nginx, you do the same in the server block configuration. For Windows servers running IIS, you import the certificate through the IIS Manager interface. Most hosting control panels (cPanel, Plesk) provide a graphical interface for this step, so you don't need to edit configuration files by hand.
Renewing your certificate before it expires
SSL certificates expire and must be renewed. Let's Encrypt certificates expire every 90 days, but renewal is automatic if you use their recommended tools (Certbot). You don't need to do anything — the certificate renews in the background.
Paid certificates expire after one year. Most certificate authorities send reminder emails 60 days before expiration. You log into your account, pay the renewal fee, and go through domain verification again. Your hosting provider may handle this automatically if you've set up auto-renewal in their dashboard.
If a certificate expires and you don't renew it, browsers will show a warning and many will block the connection. Visitors may see "Your connection is not private" or "This site's certificate has expired." Renewing takes minutes if you do it before expiration, so set a calendar reminder or enable auto-renewal.
Wildcard and multi-domain certificates
A standard SSL certificate protects one domain: example.com. If you have subdomains like blog.example.com or shop.example.com, a standard certificate won't protect them.
A wildcard certificate covers a domain and all its subdomains. It costs $20–$150 per year (more than a standard certificate) and uses the format *.example.com. One wildcard certificate protects example.com, blog.example.com, shop.example.com, and any other subdomain you create. Let's Encrypt offers free wildcard certificates.
A multi-domain certificate (also called a SAN certificate) protects multiple unrelated domains in one certificate: example.com, yourshop.com, and myblog.net all on the same certificate. These cost $100–$300 per year and are useful if you run several websites but want to manage one certificate. Let's Encrypt doesn't offer multi-domain certificates, so you'll need a paid provider.
If you have a few subdomains, a wildcard certificate is simpler and cheaper. If you have many separate domains, a multi-domain certificate consolidates management, but you'll need to renew them all at once.
What happens if you don't have an SSL certificate
Modern browsers treat unencrypted websites as unsafe. Chrome, Firefox, Safari, and Edge all show a warning before allowing visitors to proceed. On mobile browsers, the warning is more aggressive and many users will leave rather than click through.
Search engines also penalize unencrypted sites. Google has stated that HTTPS is a ranking factor, meaning sites without SSL certificates rank lower in search results than identical sites with certificates.
If you collect any information from visitors — email addresses, passwords, payment information — you have a legal obligation to encrypt it. Many jurisdictions require HTTPS for any site handling personal data. Failing to use SSL can expose you to liability if data is intercepted.
Frequently Asked Questions
Can I use the same SSL certificate on multiple servers?
No. Each certificate is tied to one server's private key. If you move the certificate to a different server, it won't work because the private key won't match. You can install the same certificate on multiple servers only if they share the same private key, which is not recommended for security reasons. Instead, request a separate certificate for each server or use a multi-domain certificate if the servers host different domains.
What's the difference between HTTP and HTTPS?
HTTP sends data in plain text that anyone on the network can read. HTTPS encrypts the data using the SSL certificate, so only your browser and the server can read it. HTTPS requires an SSL certificate; HTTP does not. All modern websites should use HTTPS.
Do I need a different certificate for www.example.com and example.com?
No. Most certificate authorities issue certificates that cover both the domain and the www subdomain automatically. When you request a certificate for example.com, it protects both example.com and www.example.com. Check your certificate authority's documentation to confirm, but this is standard practice.
What if I lose my private key?
You'll need to request a new certificate. The private key is generated when you create the certificate request and cannot be recovered. Most certificate authorities allow you to reissue a certificate at no extra cost if you lose the key. Contact your certificate authority's support team and they'll walk you through the reissue process.
How long does it take to get an SSL certificate?
Free certificates from Let's Encrypt are issued within minutes. Paid certificates usually issue within a few hours to one business day, depending on the verification method you choose. Email verification is fastest; DNS verification takes longer because DNS changes propagate across the internet. Extended Validation certificates take several business days because the authority verifies your business information manually.