Skip to main content
MI Support IT logo

IT security

What is an SSL certificate?

An SSL certificate puts the padlock and HTTPS on your website. Technically it is called TLS today. See the certificate types, and what happens when one expires.

In short

An SSL certificate is the digital certificate that enables a website to run HTTPS: It proves to the browser that the server is who it claims to be and establishes the encrypted connection symbolised by the padlock in the address bar.

Technically the name is outdated (the SSL protocol was replaced by TLS many years ago, and an 'SSL certificate' is really a TLS certificate today), but SSL has stuck as the everyday term, and vendors still sell the product under that name.

Certificates are issued by a certificate authority, come in the validation levels DV, OV and EV, and currently have a maximum lifetime of 398 days, which the industry body the CA/Browser Forum is in the process of shortening significantly. An expired certificate means alarming error pages and broken integrations, so renewal should be automated. MI Support IT manages the certificate lifecycle for Danish businesses as part of PKI management.

Back to the glossary

What is an SSL certificate?

An SSL certificate is a digital certificate that binds a domain name to a cryptographic key. When the browser visits the https:// version of a site, the server presents the certificate, the browser checks that it is issued by a trusted certificate authority and matches the domain, and only then is the encrypted connection established. The certificate thus solves two problems at once: identity (you are talking to the right server) and confidentiality (nobody can read along the way).

SSL vs. TLS: the naming confusion

SSL (Secure Sockets Layer) was the protocol of the 1990s; it was replaced by TLS (Transport Layer Security), and all SSL versions have long been phased out as insecure. What sits behind the padlock today is TLS 1.2 or 1.3, but the name "SSL certificate" has survived in everyday speech, in product names and in search boxes. So to clear up the confusion: an SSL certificate and a TLS certificate are the same product; SSL is just the old name that refuses to die. On this page we use the everyday term, the technology is TLS.

How to check a certificate

Click the padlock (or the settings icon) in the browser's address bar and choose to view the certificate. The three things worth checking:

  • Issued to: Does the domain match what you are actually visiting? Scam sites have padlocks too: The padlock proves encryption, not honesty.
  • Expiry date: How much longer is the certificate valid?
  • Issuer: Which CA is behind it, for example Let's Encrypt, DigiCert or GlobalSign.

Operations teams should check expiry centrally rather than in the browser: Several online tools and monitoring systems can keep an eye on all your domains automatically.

What happens when the certificate expires?

The browser shows a full-screen warning ("Your connection is not private") that most visitors rightly turn back from. But the damage rarely stops there: API integrations fail, mail flows stop, and internal systems that talk to each other over TLS stop working. With a maximum lifetime of 398 days (and industry plans to shorten it to under 50 days over the coming years), manual renewal in a calendar is not a sustainable strategy. Automation via ACME and control of the entire certificate lifecycle is the way forward.

DV, OV and EV certificates

Certificates come in three validation levels: DV (Domain Validation) only proves control of the domain, is issued automatically in minutes and is free from Let's Encrypt. It is plenty for most websites. OV (Organization Validation) adds a check that the organisation behind it exists, and is typically used by companies that want their company name in the certificate. EV (Extended Validation) has the most thorough vetting, but browsers no longer show the green bar that was EV's original selling point. The encryption is exactly as strong in all three. The only difference is how thoroughly the issuer has verified who you are.

How MI Support IT can help

MI Support IT keeps your certificates under control (inventory, automated renewal and expiry monitoring across domains and systems) as part of PKI management. Contact us before the next certificate expires on a Friday evening.

Shall we talk about your business and your needs?

Real people talking to real people. We get back to you the same day.

Write to usBook a meeting