A TLS certificate proves a website is who it claims to be and encrypts the data you send to it
A TLS certificate is a digital document that a website installs on its server. It does two things: it tells your browser that the website is legitimate (not a fake copy trying to steal your information), and it turns on the encryption that scrambles your data while it travels between your computer and the website's server.
When you visit a website with a TLS certificate, you see a padlock icon in your browser's address bar and the web address starts with "https://" instead of "http://". That padlock means the connection is encrypted and the website has been verified. Without a TLS certificate, your passwords, credit card numbers, and other sensitive information would travel across the internet in plain text that anyone on the network could read.
A certificate is issued by a certificate authority — an organization that checks whether the website owner actually controls the domain name they claim to own. The certificate authority then signs the certificate digitally, which tells your browser: "I have verified this website, and you can trust it."
Key Takeaways
- A TLS certificate encrypts data between your browser and a website's server so passwords and payment information cannot be read in transit.
- The certificate proves the website is legitimate by being signed by a certificate authority that has verified the website owner's identity.
- You can see whether a website has a valid TLS certificate by looking for the padlock icon and "https://" in the address bar.
- Websites that handle sensitive information — banking, shopping, email — must have a TLS certificate or your browser will warn you before you enter the site.
How a TLS certificate works when you visit a website
When you type a web address into your browser and press Enter, your browser connects to the website's server. Before any data is sent, the server presents its TLS certificate to your browser. Your browser checks whether the certificate is valid by confirming that a trusted certificate authority signed it and that the domain name on the certificate matches the website you are trying to visit.
If the certificate is valid, your browser and the server use information from the certificate to create an encrypted connection. From that point on, everything you type — your login credentials, search queries, payment information — is scrambled before it leaves your computer. The server receives the scrambled data, unscrambles it, and responds with encrypted data of its own. Your browser unscrambles the response so you can read it.
If the certificate is missing, expired, or does not match the domain name, your browser displays a warning. Most people see this warning when they accidentally visit a website with "http://" instead of "https://", or when they visit a site that has not renewed its certificate. The warning does not mean the website is malicious — it means your browser cannot verify the website's identity, so the connection is not encrypted.
Who issues TLS certificates and how they verify ownership
Certificate authorities are companies that have been trusted by web browsers to verify website ownership and issue certificates. Major certificate authorities include DigiCert, Let's Encrypt, Sectigo, and GlobalSign. When a website owner wants a TLS certificate, they request one from a certificate authority and prove they control the domain name — usually by uploading a file to the website, adding a DNS record, or responding to an email sent to the domain's administrative contact.
The certificate authority checks this proof, confirms the website owner's identity, and then signs the certificate digitally. The signature is the certificate authority's promise that it has done this verification. Your browser trusts the certificate authority, so it trusts the certificate.
Different types of certificates require different levels of verification. A domain validation certificate only confirms that the applicant controls the domain name — this is the fastest and cheapest type. An organization validation certificate requires the certificate authority to verify the applicant's business registration and legal identity. An extended validation certificate requires the most thorough verification and displays a green bar in some older browsers, though this distinction has become less common.
Why websites need a TLS certificate
Any website that handles sensitive information — passwords, payment details, health records, personal identification — needs a TLS certificate. Banks, shopping sites, email providers, and social media platforms all use TLS certificates because the law and industry standards require encryption for data in transit.
Even websites that do not handle payment information benefit from TLS certificates. Search engines rank websites with HTTPS higher in search results than those without it. Visitors are more likely to trust a site with a padlock icon. And if a website collects any personal data at all — even just an email address for a newsletter — encryption protects that data from being intercepted.
For most websites, the cost and effort of obtaining a TLS certificate is minimal. Let's Encrypt, a nonprofit certificate authority, issues free certificates to any website owner who can prove they control the domain. Paid certificates from other authorities typically cost between $50 and $200 per year, though many hosting providers include a free certificate with their service.
What happens when a TLS certificate expires
TLS certificates are not permanent. They expire after a set period — usually one year, though some last for two or three years. When a certificate expires, the website can no longer use it to encrypt connections. Visitors who try to access the website see a browser warning that the certificate has expired, and the padlock icon disappears.
Website owners receive reminder emails from their certificate authority before the certificate expires. Renewing a certificate is straightforward: the owner requests a new certificate from the same or a different certificate authority, proves ownership again (usually a quick process if nothing has changed), and installs the new certificate on the server. The process typically takes minutes to hours.
Some hosting providers and certificate authorities offer automatic renewal, which means a new certificate is issued and installed without the owner having to do anything. This prevents the accidental expiration that sometimes happens when a website owner forgets to renew manually.
How to check if a website's TLS certificate is valid
The simplest way to check is to look at the address bar. If you see "https://" and a padlock icon, the website has a valid TLS certificate. If you see "http://" without the padlock, it does not.
You can also click the padlock icon to see more details about the certificate. Your browser will show you the certificate authority that issued it, the domain name it covers, and the expiration date. If you want to see even more technical details, you can right-click the padlock, select "Certificate" or "View Certificate" (the exact wording depends on your browser), and read the full certificate information.
If a website shows a warning about the certificate — such as "Your connection is not private" or "Certificate not trusted" — do not enter sensitive information on that site. The warning usually means the certificate has expired, the domain name does not match, or the certificate was issued by an authority your browser does not recognize. You can still browse the site if you choose to, but your data will not be encrypted.
The difference between TLS and SSL
You may see the terms "SSL certificate" and "TLS certificate" used interchangeably, but they are not quite the same. SSL (find Sockets Layer) was the original encryption protocol, released in the 1990s. TLS (Transport Layer Security) is the newer version that replaced it. SSL is now considered insecure and has not been updated since 2000, so modern websites do not use it.
The term "SSL certificate" is still common in marketing and casual conversation because it was the standard name for so long. When someone says "SSL certificate," they almost always mean a TLS certificate. The padlock icon and "https://" in your browser indicate that TLS encryption is active, not SSL.
Frequently Asked Questions
Can a website with a TLS certificate still be unsafe?
Yes. A TLS certificate only encrypts data in transit and verifies the website's identity — it does not may provide the website is legitimate or that its code is find. A malicious website can have a valid TLS certificate. Always check the domain name carefully and use common sense: if a site asks for your password or payment information, make sure it is the real site you intended to visit.
What does "self-signed certificate" mean?
A self-signed certificate is one that the website owner created and signed themselves, rather than having a certificate authority sign it. Browsers do not trust self-signed certificates because there is no third party verifying the website's identity. You will see a warning if you try to visit a site with a self-signed certificate. They are sometimes used for internal company networks or testing, but never for public websites.
Do I need a different TLS certificate for each domain I own?
Not necessarily. A single certificate can cover one domain, multiple subdomains of the same domain, or multiple unrelated domains. A wildcard certificate covers a domain and all its subdomains (like example.com, mail.example.com, and blog.example.com). A multi-domain certificate covers several different domains with one certificate. Your certificate authority can explain which option makes sense for your situation.
Who pays for a TLS certificate?
The website owner pays for the certificate, not the visitor. Many hosting providers include a free TLS certificate with their service. Let's Encrypt offers free certificates to anyone. Paid certificates from other authorities typically cost $50 to $200 per year, though some are more expensive if they include additional features or higher levels of verification.