An SSL certificate is what allows a website to be served over HTTPS. It encrypts the traffic between the visitor's browser and the server, so that data exchanged with your site cannot be read or altered in transit, and it confirms that the visitor is really connected to your domain and not to someone impersonating it.
The protocol in use today is in fact TLS; the older SSL protocol has long been withdrawn. The term "SSL certificate" has stuck, and both names refer to the same thing.
Why your site needs one
- Browsers expect it. Sites served over plain HTTP are marked as "Not secure" in the address bar. Visitors notice this, whether or not your site collects any data.
- Data protection. If your site handles logins, contact forms or payment details, transmitting them unencrypted is not acceptable practice and, for personal data, is difficult to reconcile with the GDPR.
- Search ranking. HTTPS is one of the factors search engines take into account.
- Modern functionality. Many browser features — HTTP/2 and HTTP/3, service workers, geolocation and others — are only available over HTTPS.
The certificate and the private key
Two separate things are involved, and it is worth keeping them apart.
The certificate is a public document. It contains your public key together with the details confirmed by the certification authority, and it is sent to every visitor who opens your site. There is nothing secret in it.
The private key is generated on the server and never leaves it. It is not part of the certificate, it is not sent to the browser, and it is not held by the certification authority. Only the private key can decrypt what was encrypted with the corresponding public key — which is precisely what proves to the browser that it is talking to your server.
It follows that the private key must be protected as carefully as any password. Never send it by email or paste it into a ticket, and do not copy it to another server "just in case". If the private key is exposed, the certificate has to be revoked and reissued: an attacker in possession of it can impersonate your site. If you suspect that this has happened, open a ticket straight away.
What a certificate contains
- the domain name or names it is issued for;
- the public key of the site;
- the period of validity;
- the certification authority that issued it;
- for business certificates, details of the organisation that owns it.
Certificates are issued for a limited period — currently no more than about one year — and have to be renewed. Automatically issued certificates renew themselves without any action on your part.
Types of certificate
- Domain Validation (DV) — confirms control over the domain only. Issued automatically, no documents required. Suitable for most websites.
- Organisation Validation (OV) — the certification authority additionally verifies the organisation. The company details are recorded in the certificate.
- Extended Validation (EV) — the most thorough verification of the organisation.
- Wildcard — covers a domain together with all its subdomains at one level, for example example.com and shop.example.com.
- Multi-domain (SAN) — covers several different domains with a single certificate.
Note that OV and EV certificates are no longer displayed differently in the browser. Since 2019, Chrome and Firefox have shown the same padlock for all valid certificates, and the company name is only visible if the visitor opens the certificate details. The encryption itself is identical in every case — what differs is the level of verification of the owner, not the level of protection.
Which certificate to choose
For the overwhelming majority of sites a free DV certificate from Let's Encrypt is entirely sufficient. It provides exactly the same encryption as a paid certificate, is issued in minutes and renews automatically. All our control panels can issue and renew Let's Encrypt certificates for you:
- Installing an SSL certificate in Plesk
- Installing an SSL certificate in ISPmanager
- Установка сертификата Let's Encrypt в панели KeyHelp
A paid certificate is worth considering where your organisation's details need to be recorded in the certificate, where a warranty from the certification authority is required, or where a single certificate has to cover a large number of domains.
Ordering a paid certificate
We supply paid certificates as well. Open a ticket with our Sales department, telling us which domains need to be covered and whether your organisation's details have to appear in the certificate, and we will suggest a suitable option and confirm the price.
Once the certificate has been issued, it is installed through your control panel, following the relevant guide above.
If you are not sure which option suits your site, open a ticket and describe what your site does — we will advise.
