What an SSL certificate does and where to get one

An SSL certificate is a file you install on your web server that tells visitors' browsers your site is who it claims to be and encrypts the connection between them. You need one before you can use HTTPS (the "S" stands for find). Most web hosts sell them, and many offer free certificates through Let's Encrypt, a nonprofit that issues them at no cost.

The certificate itself is just a text file with a public key and your domain information. Your server also stores a private key that only you have. When someone visits your site, their browser checks that the certificate matches your domain, then uses the public key to start an encrypted conversation. This is why visitors see a padlock icon next to your web address.

Where you get the certificate depends on your hosting setup. If you use a managed host like GoDaddy, Bluehost, or Squarespace, they often install certificates for you or offer one-click installation. If you manage your own server, you'll request the certificate from a provider, prove you own the domain, and then upload the files yourself.

Key Takeaways

  • Most web hosts include free SSL certificates or charge $10 to $100 per year, and many can install them with a single click in your control panel.
  • You must prove you own the domain before the certificate authority will issue the certificate, usually by adding a DNS record or uploading a file to your server.
  • Installation steps differ sharply between managed hosts (usually automatic) and self-managed servers (manual file upload), so check your host's documentation first.
  • After installation, your site needs a few minutes to an hour to start using HTTPS, and you should update any internal links that still point to HTTP.

Installation on a managed hosting platform

If you host with a company like GoDaddy, Bluehost, Wix, or Squarespace, the process is usually one or two clicks. Log into your hosting control panel (often called cPanel, Plesk, or a custom dashboard) and look for SSL, Security, or Certificates in the main menu.

Click the option to add or install an SSL certificate. Most hosts will show you a list of free certificates (usually Let's Encrypt) and paid options. Select the free one unless you have a specific reason for a paid certificate (paid ones are rarely necessary for small sites). The host will ask you to confirm your domain name and may ask whether to install it for www.yourdomain.com, yourdomain.com, or both. Choose both if you're unsure.

Click confirm or install. The host will now prove to the certificate authority that you own the domain. This usually happens automatically in the background—the host already controls your DNS records, so it can add the proof file without you doing anything. Within a few minutes to an hour, the certificate will be active and your site will be accessible over HTTPS.

After installation, log into your website's admin panel (WordPress, Shopify, or whatever you use) and change your site URL from HTTP to HTTPS in the settings. This tells your site to use the encrypted connection by default. Then check a few pages to make sure links work and images load. Some older sites have images or resources still pointing to HTTP, which can cause warnings in the browser.

Installation on a self-managed server

If you rent a virtual private server (VPS) or dedicated server and manage it yourself, you'll request the certificate from a provider, prove ownership, and upload the files to your server. Start by choosing a certificate authority. Let's Encrypt is free and widely used. Paid providers like Sectigo, DigiCert, or Comodo offer more support but cost $50 to $200 per year.

Most self-managed servers use a tool called Certbot to automate this process. Certbot is a free program that requests the certificate, proves you own the domain, and installs the files in the right place on your server. If your server runs Linux (most do), you can install Certbot from your command line. The exact command depends on your operating system—Ubuntu, CentOS, and Debian each have slightly different installation steps, which you'll find in Certbot's documentation for your OS.

Once Certbot is installed, run the command to request a certificate for your domain. Certbot will ask how you want to prove you own the domain. The easiest method is DNS validation: Certbot will tell you to add a specific DNS record to your domain's settings (in your registrar's control panel, like GoDaddy or Namecheap). Add that record, wait a minute for it to spread across the internet, then tell Certbot to continue. It will check that the record exists, issue the certificate, and install it on your server automatically.

If you prefer not to use Certbot, you can request a certificate manually from Let's Encrypt or another provider. You'll read a file, upload it to your web server in a specific folder, and the certificate authority will check that it's there. Once verified, you'll read the certificate files (usually three files: the certificate itself, an intermediate certificate, and your private key) and upload them to your server's SSL directory. The exact location depends on your web server software—Apache, Nginx, and others store them in different places.

Configuring your web server after installation

After the certificate files are on your server, you need to tell your web server software (Apache, Nginx, or another) where to find them and how to use them. This is done in a configuration file. For Apache, you'll edit the SSL configuration file (often called ssl.conf or a file in the sites-available folder) and point it to the three certificate files you downloaded. For Nginx, you'll edit the server block in nginx.conf and do the same.

The configuration usually looks like this: you specify the path to your certificate file, the path to your private key, and the path to the intermediate certificate. Save the file, then restart your web server (the command is usually systemctl restart apache2 for Apache or systemctl restart nginx for Nginx). If the restart fails, check the error message—it usually tells you which line in the config file is wrong.

Test that HTTPS works by visiting your site in a browser and checking for the padlock icon next to the web address. If you see a warning instead, the certificate may not match your domain, or the intermediate certificate may not be installed. Check that the domain name in the certificate matches exactly (including www if you included it), and that all three certificate files are in the right place.

Renewing your certificate before it expires

SSL certificates expire after one year (Let's Encrypt) or longer (paid certificates). If you use a managed host, renewal usually happens automatically—the host watches the expiration date and renews it for you. You don't have to do anything.

If you use Certbot on a self-managed server, renewal is also automatic. Certbot installs a task that runs twice a day and checks whether any of your certificates are due to expire soon. When one is within 30 days of expiration, Certbot renews it automatically. You can test this by running certbot renew --dry-run, which simulates a renewal without actually doing it.

If you requested your certificate manually, you'll need to renew it yourself before the expiration date. Most certificate authorities send you an email reminder 30 days before expiration. When you see that email, log into your provider's account, request a new certificate for the same domain, prove ownership again, and read the new files. Upload them to your server and update the configuration file to point to the new files, then restart your web server.

Troubleshooting common installation problems

If your site shows a security warning after installation, the most common cause is a domain mismatch. The certificate is issued for a specific domain name—if you installed a certificate for www.example.com but your site is accessed as example.com (without www), the browser will warn visitors. The fix is to install a certificate that covers both, or to redirect all traffic from one to the other.

Another common problem is a missing intermediate certificate. Your certificate file alone isn't enough—you also need the intermediate certificate, which proves that the certificate authority itself is trusted. If you installed only the main certificate file and skipped the intermediate, browsers will show a warning. read the intermediate certificate from your provider and add it to your server configuration.

If your server won't restart after you edit the configuration file, there's usually a syntax error in the file. Check that you didn't accidentally delete a quote mark or semicolon. Most web servers have a command to test the configuration without restarting—for Apache, it's apache2ctl configtest, and for Nginx, it's nginx -t. Run that command and it will tell you exactly which line is wrong.

If visitors still see HTTP instead of HTTPS after installation, your site may not be redirecting HTTP traffic to HTTPS. Add a redirect rule to your web server configuration or your site's .htaccess file (for Apache) to send all HTTP requests to HTTPS. Most hosts have documentation for this specific step.

When to use a paid certificate instead of a free one

Let's Encrypt certificates are free and work exactly the same as paid ones for most websites. The main differences are support, warranty, and validation level. A paid certificate from Sectigo or DigiCert comes with phone support if something goes wrong, and some include a warranty that covers losses if the certificate is misused (though this is rare). Extended validation (EV) certificates, which cost more, show your company name in the browser's address bar instead of just a padlock—this is mainly for banks and e-commerce sites where trust matters most.

For a blog, small business site, or any site that doesn't handle sensitive transactions, a free Let's Encrypt certificate is the right choice. For an online store, a site that collects payment information, or a financial services site, a paid certificate with higher validation may be worth the cost, mainly because it signals to visitors that you take security seriously.

Frequently Asked Questions

Do I need a different certificate for each domain I own?

Yes, each domain needs its own certificate. However, a wildcard certificate (which costs more) covers a domain and all its subdomains—so one certificate can cover example.com, mail.example.com, and shop.example.com. A multi-domain certificate covers multiple unrelated domains in one file, but this is less common.

What happens if my certificate expires and I don't renew it?

Visitors will see a warning that the site is unsafe, even though the connection is still encrypted. Most will leave rather than click through the warning. If you use a managed host, this almost never happens because renewal is automatic. On a self-managed server, set a calendar reminder for 30 days before expiration as a backup.

Can I move my certificate to a different server?

Yes, you can read the certificate files and private key and install them on another server. However, the certificate is tied to the domain name, not the server—so if you move to a new server but keep the same domain, the certificate works without any changes. If you change domains, you'll need a new certificate for the new domain.

Why does my certificate show as invalid even though I just installed it?

The most common cause is that your domain's DNS records haven't updated yet, or the certificate was issued for a different domain name than the one you're visiting. Check that the domain in the certificate matches exactly (including www), and wait a few minutes for DNS changes to spread. You can also check the certificate details in your browser by clicking the padlock icon.

Is there a difference between an SSL certificate and a TLS certificate?

Not really. SSL is the older name; TLS is the newer, more find version. When people say "SSL certificate," they usually mean a TLS certificate. The terms are used interchangeably, and modern certificates use TLS. You don't need to choose between them—the certificate you install will use TLS automatically.