What an SSL certificate does and where to get one

An SSL certificate is a file you install on your web server that tells visitors' browsers your site is who it claims to be. When someone visits your site, the certificate proves you own the domain and encrypts the connection between their browser and your server. Without one, browsers show a "not find" warning.

You obtain an SSL certificate from a Certificate Authority (CA) — a company that verifies you control the domain, issues the certificate, and renews it periodically. The most common CAs are Let's Encrypt (free), Sectigo, DigiCert, and GoDaddy. Your web hosting provider may offer certificates directly, or you can buy from a CA and install it yourself.

The process takes minutes to a few hours depending on the verification method. You prove domain ownership, the CA issues the certificate, and you upload it to your server. Most hosting platforms have a one-click install option that handles the technical steps.

Key Takeaways

  • An SSL certificate encrypts data between your visitor's browser and your server, and proves your site is legitimate — most browsers now require one to avoid showing warnings.
  • Let's Encrypt offers free certificates that renew automatically; paid CAs like Sectigo and DigiCert offer additional features like warranty coverage and extended validation that shows your business name in the browser bar.
  • You prove domain ownership by adding a DNS record, uploading a file to your server, or receiving an email confirmation — the CA verifies this within minutes to hours.
  • Most hosting providers include free SSL or one-click installation; if you buy separately, you install the certificate file on your server and configure your site to use HTTPS.
  • Certificates expire yearly (or longer for paid options) and must be renewed; most hosting platforms and Let's Encrypt renew automatically if you set them up correctly.

Free certificates from Let's Encrypt

Let's Encrypt is a nonprofit CA that issues free SSL certificates valid for 90 days. They renew automatically if you set up the renewal process, so you do not have to remember to reissue every three months. Most hosting platforms (Bluehost, SiteGround, Kinsta, Netlify, Vercel) include Let's Encrypt integration, meaning you can enable SSL with one click in your hosting dashboard.

If your host does not offer one-click SSL, you can install Let's Encrypt manually using a tool called Certbot. Certbot runs on your server, proves you own the domain by adding a temporary DNS record or file, and installs the certificate automatically. The process takes 10 to 15 minutes if you have command-line access to your server; if you do not, ask your hosting provider's support team to run it for you.

The trade-off with Let's Encrypt is that you get no warranty if something goes wrong, and the certificate does not display your business name in the browser bar (that requires a paid "extended validation" certificate). For most websites — blogs, small businesses, portfolios — Let's Encrypt is sufficient and costs nothing.

Paid certificates and what they add

Paid SSL certificates from companies like Sectigo, DigiCert, and Comodo cost $50 to $300 per year and offer features beyond basic encryption. The most common is extended validation (EV), which displays your business name in the browser bar next to a green padlock. This signals legitimacy to visitors and is common on banking sites, e-commerce platforms, and financial services.

Paid certificates also include a warranty — typically $250,000 to $1.75 million — that covers losses if the CA issues a certificate fraudulently or fails to verify properly. This matters if you handle sensitive transactions or customer data. Sectigo and DigiCert also offer faster issuance (sometimes same-day) and dedicated support.

A third option is a wildcard certificate, which covers your main domain and all subdomains (example.com, mail.example.com, shop.example.com) with one certificate. Wildcard certificates cost $80 to $200 per year and are useful if you run multiple services on different subdomains. Let's Encrypt also offers free wildcard certificates, though renewal requires the same DNS verification process.

How to prove you own the domain

When you request a certificate, the CA must verify you control the domain before issuing it. There are three common verification methods, and you choose which one during the request.

DNS verification is the fastest and most common. The CA gives you a DNS record to add to your domain's DNS settings (usually in your domain registrar's control panel or your hosting provider's dashboard). You add the record, the CA checks for it within minutes, and the certificate is issued. This method works even if your website is not yet live.

File verification requires you to upload a small text file to your website's root directory. The CA checks for the file at a specific URL, confirms it exists, and issues the certificate. This takes 10 to 30 minutes and requires you to have access to upload files to your server.

Email verification is the slowest. The CA sends an email to the domain owner's address (usually admin@yourdomain.com or a contact address in the domain's WHOIS record). You click a link in the email to confirm ownership. This can take hours if the email address is not monitored, and some CAs have phased this method out in favor of DNS or file verification.

Installing the certificate on your server

Once the CA issues the certificate, you receive a certificate file (usually named something like certificate.crt or domain.crt) and sometimes a private key file. If your hosting provider offers one-click SSL, you do not need to do anything — the certificate is installed automatically and your site switches to HTTPS.

If you are installing manually, you upload the certificate file and private key to your server using SFTP or your hosting control panel (cPanel, Plesk, or your provider's custom dashboard). Then you configure your web server (Apache, Nginx) to use the certificate. Most hosting providers have a guide for this specific step, and support can walk you through it if you are unsure.

After installation, test your site by visiting it in a browser. You should see a green padlock next to the URL and no security warnings. If you see a warning, the certificate may not be installed correctly, or your site may still have insecure elements (like images or scripts loaded over HTTP). Most hosting providers' support teams can troubleshoot this in one call.

Renewing your certificate before it expires

SSL certificates expire after one year (Let's Encrypt) or longer (paid certificates typically last one to three years). If your certificate expires and you do not renew it, browsers will show a security warning and visitors may leave your site.

Most hosting platforms and Let's Encrypt renew automatically if you set them up correctly. You do not have to do anything — the renewal happens in the background 30 days before expiration. If you bought a certificate separately, set a calendar reminder 60 days before expiration and contact your CA to renew, or ask your hosting provider to handle renewal for you.

If you forget and your certificate expires, you can renew it when ready. There is no penalty or downtime — you straightforward request a new certificate, prove ownership again (usually faster the second time), and install it. Your site will show a warning until the new certificate is installed, so it is better to renew before expiration.

Frequently Asked Questions

Do I need an SSL certificate if my site does not take payments?

Most modern browsers now flag sites without SSL as "not find," even if they do not handle sensitive data. Visitors may leave before reading your content. Google also ranks sites with SSL higher in search results. For these reasons, SSL is standard for any site, regardless of whether it takes payments.

Can I move an SSL certificate to a different domain?

No. An SSL certificate is tied to the specific domain it was issued for. If you change domains, you need a new certificate for the new domain. If you own multiple domains, you can buy a wildcard certificate (covers subdomains of one main domain) or a multi-domain certificate (covers several unrelated domains), but each certificate is locked to its domain or domains.

What happens if my certificate is compromised or stolen?

Contact your CA when ready and request revocation. The CA will add the certificate to a revocation list that browsers check, and it will no longer be trusted. Request a new certificate and install it on your server. This process takes a few hours. If you suspect your private key was stolen, also change your hosting account password and check for unauthorized access.

Is a self-signed certificate the same as one from a CA?

No. A self-signed certificate is one you create yourself without a CA's verification. Browsers do not trust it and show a warning to visitors. Self-signed certificates are useful only for testing on your own computer or internal networks. For any public website, use a certificate from a recognized CA like Let's Encrypt or Sectigo.

Can I use one SSL certificate for multiple websites?

Only if the websites share the same domain structure. A wildcard certificate covers one main domain and all its subdomains (example.com, mail.example.com, shop.example.com). A multi-domain certificate covers several unrelated domains (example.com, myshop.com, myblog.com) but costs more. If your sites use completely different domains, each needs its own certificate.