{"id":153,"date":"2026-05-27T23:12:47","date_gmt":"2026-05-28T06:12:47","guid":{"rendered":"https:\/\/hostandtech.com\/kb\/ssl\/what-is-ssl-certificate-and-why-you-need-it\/"},"modified":"2026-05-27T23:12:47","modified_gmt":"2026-05-28T06:12:47","slug":"what-is-ssl-certificate-and-why-you-need-it","status":"publish","type":"post","link":"https:\/\/hostandtech.com\/kb\/ssl\/what-is-ssl-certificate-and-why-you-need-it\/","title":{"rendered":"What Is an SSL Certificate and Why Does Your Website Need One?"},"content":{"rendered":"

Overview<\/h2>\n

An SSL certificate (technically TLS these days, but everyone still says SSL) is a small digital file installed on your server that does two things: it encrypts traffic between your server and a visitor’s browser, and it verifies that your site is actually who it claims to be. When SSL is active, your site loads over HTTPS<\/strong> instead of HTTP, and visitors see a padlock icon in the browser address bar.<\/p>\n

If your site doesn’t have a valid SSL certificate, Chrome, Firefox, and Safari will display a “Not Secure” warning before users even reach your content. For anything involving logins, contact forms, or payments, that warning is effectively a stop sign. Even for a simple blog, missing HTTPS hurts your search engine rankings \u2014 Google has used HTTPS as a ranking signal since 2014.<\/p>\n

This article explains what SSL certificates are, the different types available, what happens when things go wrong, and how to verify your certificate is working properly. If you’re on a Host & Tech Shared Hosting<\/a> plan, you likely already have access to a free Let’s Encrypt certificate \u2014 but there are still a few things worth knowing before you assume everything’s configured correctly.<\/p>\n

Prerequisites<\/h2>\n
    \n
  • Access to your hosting control panel (cPanel, Plesk, or WHM) or your Host & Tech client area<\/li>\n
  • A domain name pointed to your hosting account (DNS must be fully propagated \u2014 usually 24\u201348 hours after any recent changes)<\/li>\n
  • Basic understanding of what a domain name and web server are<\/li>\n
  • For wildcard or OV\/EV certificates: ability to verify domain or business ownership via email or DNS record<\/li>\n<\/ul>\n

    How SSL Actually Works<\/h2>\n

    When a visitor’s browser connects to your site, SSL does a quick handshake before any page content loads. The server presents its certificate, the browser verifies it was issued by a trusted Certificate Authority (CA), and both sides agree on an encryption key for that session. All data sent after that \u2014 form submissions, login credentials, payment details \u2014 is encrypted in transit.<\/p>\n

    The certificate itself contains your domain name, the name of the CA that issued it, and an expiry date. If any of those don’t check out (wrong domain, expired cert, self-signed cert not from a trusted CA), the browser throws a warning. This is why a certificate issued for example.com<\/code> won’t work on shop.example.com<\/code> unless it’s a wildcard cert covering *.example.com<\/code>.<\/p>\n

    One thing beginners often don’t realise: SSL doesn’t make your website secure in a broad sense. It protects data in transit<\/em>. A site with SSL can still have vulnerable plugins, weak passwords, or an outdated CMS. SSL is one layer of security, not a complete solution.<\/p>\n

    Types of SSL Certificates<\/h2>\n

    Domain Validated (DV)<\/h3>\n

    The CA confirms you control the domain \u2014 nothing more. Issued in minutes, often free via Let’s Encrypt. This is what most websites use and it’s perfectly adequate for blogs, portfolios, and small business sites. The padlock looks identical to more expensive certificates in every browser.<\/p>\n

    Organisation Validated (OV)<\/h3>\n

    The CA verifies your domain and<\/em> your organisation’s legal existence. Takes a few days. Shows your company name in the certificate details (not in the address bar, but users can click the padlock to see it). Worth considering for corporate sites where business legitimacy matters.<\/p>\n

    Extended Validation (EV)<\/h3>\n

    The most thorough vetting \u2014 the CA confirms your legal entity, physical address, and operational status. Previously showed a green address bar with your company name, but major browsers dropped that visual treatment around 2019. EV certs are still used by financial institutions and large enterprises, but the visible difference to end users is now minimal.<\/p>\n

    Wildcard Certificates<\/h3>\n

    Covers your root domain and all first-level subdomains: a cert for *.example.com<\/code> works on www.example.com<\/code>, mail.example.com<\/code>, shop.example.com<\/code>, and so on. It does not<\/em> cover sub.shop.example.com<\/code> \u2014 that’s two levels deep and requires a separate cert or a multi-domain (SAN) certificate.<\/p>\n

    Multi-Domain (SAN) Certificates<\/h3>\n

    Covers a list of specific domains and subdomains in a single certificate using Subject Alternative Names. Useful if you manage several unrelated domains on one server.<\/p>\n

    Free vs. Paid SSL Certificates<\/h2>\n

    Let’s Encrypt provides free DV certificates and is trusted by all major browsers. The certificates expire every 90 days, but on any properly configured hosting account (including all Host & Tech shared hosting plans), renewal is automatic. I’d recommend checking that auto-renewal is actually running rather than assuming it is \u2014 more on that in the troubleshooting section below.<\/p>\n

    Paid certificates from CAs like Sectigo, DigiCert, or GlobalSign make sense when you need OV\/EV validation, a wildcard that Let’s Encrypt’s ACME client isn’t issuing cleanly in your environment, or when your organisation requires a commercially backed warranty (some enterprises require this for compliance reasons). For the vast majority of sites, a free Let’s Encrypt cert is the right call.<\/p>\n

    How to Verify Your SSL Certificate Is Working<\/h2>\n
      \n
    1. \n Check the browser padlock.<\/strong> Load your site over https:\/\/yourdomain.com<\/code> and click the padlock icon. The browser will show the certificate details, including who issued it and when it expires.\n <\/li>\n
    2. \n Run an SSL Labs scan.<\/strong> Go to https:\/\/www.ssllabs.com\/ssltest\/<\/code> and enter your domain. It’ll grade your certificate and TLS configuration, flag weak cipher suites, and flag chain issues. An A or A+ rating is what you want.\n <\/li>\n
    3. \n Check expiry from the command line.<\/strong> If you have SSH access to your server, run:<\/p>\n