What Is an SSL Certificate?

You have seen the little padlock in your browser's address bar and the https at the start of a web address. Both are signs that a website has an SSL certificate. It is one of the most important and least understood pieces of everyday web security.

Whether you run a website or simply use them, knowing what an SSL certificate does — and what it does not — helps you stay safer online.

What an SSL certificate is

An SSL certificate is a small digital file installed on a website that allows it to create an encrypted, verified connection with visitors' browsers.

It does two things at once. First, it lets the site and your browser encrypt the data flowing between them, scrambling it so that anyone intercepting the connection sees gibberish rather than your passwords or card details. Second, it lets the website prove its identity, confirming you are really talking to the site you think you are.

When a site has a valid certificate, your browser shows https instead of http — the "s" stands for secure — and usually a padlock icon. Without one, modern browsers warn that the connection is "not secure".

A quick note on the name: SSL versus TLS

Here is a small but useful piece of jargon-busting. The technology really in use today is called TLS (Transport Layer Security). SSL (Secure Sockets Layer) was its predecessor and is now outdated.

In practice, though, almost everyone still says "SSL certificate" out of habit. So when you read SSL, mentally translate it to "the modern TLS technology". The certificate is the same file either way; only the protocol name has moved on.

What encryption protects

Without encryption, data travels across the internet in plain text. Anyone positioned along the route — on shared public Wi-Fi, for instance — could potentially read it. That is a serious problem for anything sensitive: login details, payment information, private messages.

Encryption turns that readable text into scrambled code that only the intended recipient can unlock. So even if a message is intercepted, it is useless to whoever grabs it.

Encryption does not stop someone seeing that data is being sent. It stops them understanding what the data says.

This is why an SSL certificate is essential for any site handling logins, payments or personal information — and, because it has become a baseline expectation, for ordinary informational sites too.

How it proves identity

Encryption alone is not enough. You also need to know you are encrypting your data to the right party and not to an impostor. This is where the certificate's second job comes in.

Certificates are issued by trusted organisations called certificate authorities (CAs). Before issuing one, a CA carries out checks — at minimum, confirming that the applicant controls the domain name in question. Your browser keeps a built-in list of CAs it trusts, and when it connects to a site, it verifies the certificate was issued by one of them and is valid for that domain. If anything is wrong — an expired certificate, a name mismatch — it warns you.

There are different validation levels, from basic domain checks to more thorough vetting of the organisation behind a site, but the everyday security for visitors comes chiefly from the encryption.

What happens when you connect

It helps to picture the moment a secure page loads. Before any of your data is sent, your browser and the website perform a quick, automatic exchange sometimes called a handshake. In a fraction of a second, several things happen:

• The website presents its certificate, and your browser checks that it is valid, unexpired and issued by a trusted authority for the correct address.
• The two sides agree on encryption and set up keys that only they share, so the rest of the conversation is scrambled.
• Only then does the actual page content, and anything you type, begin to flow — now protected.

You see none of this; you simply notice the padlock and the page appearing. If any check fails, though, the browser stops and warns you rather than continuing. That is the system working exactly as intended, and a warning you should never click straight past.

The padlock myth: secure is not the same as trustworthy

This is the single most important thing to understand, because misunderstanding it can be dangerous.

A padlock means the connection is encrypted and the site holds a valid certificate. It does not mean the website is honest or the business behind it is genuine. Because basic certificates are free and easy to obtain, scammers routinely put them on fraudulent sites. A phishing page can show a perfect padlock while existing only to steal your details.

So treat the padlock as one signal among many, not a seal of approval. Combine it with care about the web address itself, checking it matches exactly before you trust a page. Strong site security overall is part of broader cybersecurity thinking, not a single icon.

What it means for site owners

If you run a website, an SSL certificate is no longer optional:

• Browsers flag sites without one as "not secure", which deters visitors.
• Search engines favour secure sites, so it supports your visibility, alongside other SEO basics.
• Visitors expect it. A missing padlock erodes trust instantly.

The good news is that getting one is easier and cheaper than ever. Basic certificates are available free, and many web hosts and platforms now install and renew one automatically. Certificates do expire after a set period, so the main pitfall is letting one lapse — automatic renewal solves that.

The bottom line

An SSL certificate is the digital file that lets a website encrypt its connection with you and prove its identity, putting the padlock and the "s" in https. The technology is now properly called TLS, but the SSL name has stuck.

Crucially, the padlock confirms a secure connection, not an honest website, so it is a starting point for trust rather than a guarantee. For site owners, a certificate is now a basic requirement that is usually free and often automatic — and for everyone else, it is a useful but limited signal worth understanding clearly.