What Is an SSL Certificate? Meaning and Types (2026)

SSL stands for Secure Sockets Layer. An SSL certificate encrypts data sent between a website and a visitor’s browser. It makes information like login details, credit card numbers, and personal data harder to intercept.

In the mid-1990s, Netscape developed SSL as a security protocol for encrypting web content. SSL later evolved into TLS, or Transport Layer Security. Although SSL and TLS are different protocols, the term “SSL certificate” is still used to describe the digital certificate that helps secure website connections.

This guide covers how SSL certificates work and how to get one for your website. 

What is an SSL certificate?

An SSL certificate is a digital certificate that verifies a website’s identity, enables HTTPS, and creates an encrypted connection between the site and a browser.

Also called an SSL/TLS certificate, digital certificate, or cert, it protects data shared during a secure website connection.

Only the sender and recipient can read or modify information sent over that connection. An SSL certificate verifies the website owner’s identity and uses encryption to protect user data.

Why are SSL certificates important?

W3Techs data shows that almost 70% of all websites have an SSL certificate. The following reasons are why these protocols have become common. 

They encrypt data in transit

An SSL certificate enables HTTPS, which encrypts information sent between a website and a visitor’s browser. This protects data in transit, including passwords, contact details, and payment information.

The FTC recommends using strong cryptography to protect sensitive information during transmission and storage. It also points to TLS as one way to protect data in transit.

They authenticate the connection

SSL certificates confirm that a browser is connecting to the intended website. This reduces the risk of sending sensitive information through a connection that has been intercepted or misrepresented.

Certificate validation is part of that protection. Without it, users may be exposed to man-in-the-middle attacks, where someone intercepts information between the user and the website.

They affect browser and search context

Browsers show warnings when a page uses HTTP instead of HTTPS. These “Not Secure” warnings appear in the address bar and affect how visitors perceive a site.

HTTPS is also part of the page experience documentation for Google search. SSL certificates support HTTPS connections, which helps keep the site aligned with modern browsers and search engine expectations.

They support payment security

For ecommerce businesses, SSL/TLS helps encrypt payment information during transmission. This is one part of secure payment handling, but PCI DSS compliance still requires additional controls.

PCI DSS, or the Payment Card Industry Data Security Standard, applies to businesses that store, process, or transmit cardholder data. It covers access control, monitoring, testing, and secure system management.

Payment security is a growing concern for online stores. Juniper Research estimates the total value of ecommerce fraud will be $56.1 billion in 2025 and $131 billion in 2030.

What is an SSL certificate authority (CA)?

An SSL certificate authority (CA) is an organization that issues SSL/TLS certificates. CAs help verify that a certificate belongs to the domain or organization requesting it. Before issuing a certificate, the CA checks the information in the request.

A CA can also be part of a certificate chain. The chain connects the website’s certificate to a trusted root CA, often through one or more subordinate CAs. CA/Browser Forum requirements apply across this chain of trust.

An SSL/TLS certificate is a small digital file installed on the website’s server. It can include:

• The domain name
• The issuing CA
• The issue date
• The expiration date
• The public key
• Organization details, when applicable

Most CAs charge for certificates, but free options are also available. Let’s Encrypt is a free, automated certificate authority run by the nonprofit Internet Security Research Group. Web hosts also include free SSL/TLS certificates with hosting plans.

What is an SSL certificate chain?

An SSL certificate chain is the path a browser uses to verify that a website’s SSL/TLS certificate is issued by a trusted certificate authority. It links the website certificate to a trusted root certificate, usually through one or more intermediate certificates.

An example of an SSL certificate chain is:

Website certificate → Intermediate CA certificate → Root CA certificate → Browser trust store

The website certificate is installed on the store’s server. It identifies the domain and includes the public key used for the secure connection.

An intermediate certificate connects the website certificate to the root certificate. Certificate authorities use intermediate certificates so they can issue website certificates without exposing the root certificate directly.

The root certificate belongs to the root CA. Browsers and operating systems use trusted root stores to decide which root certificates they recognize. The CA/Browser Forum defines a root CA as the top-level certificate authority. Its baseline requirements also apply across the chain of trust, from the root CA through subordinate CAs.

Browsers need a complete and valid certificate chain before they trust an HTTPS connection. If a certificate is missing, expired, misconfigured, or issued by an unrecognized authority, shoppers may see a browser warning on the site.

How do SSL certificates work?

An SSL certificate helps verify the website’s identity and is part of the TLS handshake—the process that sets up an HTTPS connection before encrypted data is sent.

The process works like this:

1. The browser connects to the website.
2. The website sends its SSL/TLS certificate.
3. The browser checks the certificate and certificate chain.
4. The browser and server agree on encryption settings.
5. They create temporary session keys for that visit.
6. Encrypted data can then move between the browser and server.

The certificate includes the website’s public key. The matching private key stays on the server and is not shared. During the handshake, the browser uses the certificate to confirm the server’s identity and help establish a secure connection.

After the handshake, the browser and server use temporary session keys, also called traffic keys, to encrypt the data sent during that session. This is more efficient than using public-key encryption for every message. It also means the temporary keys are specific to that connection.

Most websites now use TLS, not the older SSL protocol. CISA recommends using secure and up-to-date SSL/TLS protocols and cipher suites, and disabling deprecated protocols, including SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1.

Types of SSL certificates

SSL/TLS certificates are usually grouped by validation level. All three can encrypt traffic. The main difference is how much identity information the certificate authority verifies before issuing the certificate:

• Domain validated (DV) certificate
• Organization validated (OV) certificate
• Extended validation (EV) certificate

Domain-validated (DV) certificate

Cost: Free to about $50 per year for a single-domain certificate.

A DV certificate confirms control of the domain. It’s issued through an automated check and can be available within minutes.

DV certificates are common for blogs, landing pages, portfolios, and basic business websites. Let’s Encrypt provides free TLS certificates, and SSL.com lists single-domain DV certificates from $36.75 per year.

Organization-validated (OV) certificate

Cost: About $50 to over $1,500 per year.

An OV certificate confirms domain control and verifies organization details. This can include the organization’s name and identity before the certificate is issued.

SSL.com shows single-domain OV options from $48.40 to $74.25 per year. DigiCert has OV plans from $372 to $1,548 per year.

Extended validation (EV) certificate

Cost: About $240 to over $2,200 per year.

An EV certificate uses a more detailed identity review. It verifies the organization’s legal and operational identity before issuance.

EV certificates are used by organizations that want more identity information available in certificate details. SSL.com offers single-domain EV at $239.50 per year, and DigiCert has EV plans from $540 to $2,244 per year.

The difference between HTTP and HTTPS

HTTP stands for Hypertext Transfer Protocol. It sends information between a website and its visitors in plain text, which means the data can be intercepted and read.

HTTPS stands for Hypertext Transfer Protocol Secure. It uses SSL/TLS certificates to create an encrypted connection between a website and a visitor’s browser. Data sent through the connection, such as credit card numbers or passwords, is scrambled so only the website and browser can read it.

HTTPS is now the standard for most websites. Modern browsers show a padlock icon for HTTPS sites and may label HTTP sites as “Not Secure.”

Shopify provides free TLS certificates for domains added to Shopify. After the certificate is issued, Shopify changes the store URL from HTTP to HTTPS and automatically redirects visitors who use the old HTTP version.

Stores can use Shopify’s Force HTTPS setting under Settings > Domains to redirect HTTP URLs to HTTPS. The setting sends visitors and search engines to the secure version of each page.

What to do if your SSL certificate is compromised

If your SSL/TLS certificate is compromised, act quickly to limit the risk to your site and customers.

• Revoke the certificate. Contact your certificate authority and revoke the compromised certificate. If you suspect active misuse, work with your hosting provider to limit access while you investigate.
• Investigate the cause. Review server logs, access records, and recent configuration changes. Look for signs of unauthorized access, malware, exposed private keys, or unusual connection attempts.
• Replace the certificate. Request a new certificate from your CA. Generate a new private key during the process, then install and configure the new certificate on your server.

After replacement, confirm your server is using secure HTTPS settings. Review HTTPS bindings, certificate verification settings, redirect rules, and supported TLS versions. 

CISA’s AA25-212A suggests a secure HTTPS binding configuration as part of cyber hygiene improvements. Set up certificate monitoring, renewal alerts, and security scans to catch issues early in the future.

What if you need to secure multiple domains?

Domain coverage refers to how many domains or subdomains the certificate protects. There are three types:

Single-domain certification 

Single-domain certificates are managed one at a time. Each certificate has its own renewal cycle and private key. Businesses with several domains or subdomains may need to track and renew each certificate.

Wildcard SSL certificate

Wildcard certificates reduce certificate management for sites that use several related subdomains. They apply to one subdomain level. 

For example, a wildcard certificate for *.example.com can cover shop.example.com.

Multidomain SSL certificate

Multidomain certificates use subject alternative names (SANs) to list each covered domain. Adding or removing domains may require the certificate to be updated and reissued. SAN limits vary by certificate authority.

What happens when an SSL certificate expires?

When an SSL/TLS certificate expires, browsers display a security warning before visitors can access your site. They may hesitate to enter your site after seeing a browser warning.

Avoid issues by tracking certificate renewal as part of regular website maintenance:

• Check certificate expiration dates.
• Set renewal alerts.
• Confirm the new certificate is active before the old one expires.
• Review the domain name and certificate authority in the browser address bar.

TLS certificates are free for domains added to Shopify. If a third-party domain shows SSL pending or SSL unavailable, check the domain’s DNS settings and allow up to 48 hours for the certificate to be issued.

How to get an SSL certificate

You can get an SSL/TLS certificate through a website builder, domain registrar, certificate authority, or free automated provider such as Let’s Encrypt. 

Some ecommerce platforms include SSL certificates as part of the service. Shopify provides free TLS certificates, and many certificates are issued automatically:

1. Check your platform. Start with your website platform or host. Shopify provides free TLS certificates for myshopify.com domains, domains bought or transferred through Shopify, and third-party domains connected to Shopify.
2. Connect your domain. Point the required DNS records to Shopify. Certificate issuance can take up to 48 hours. During this time, the domain may show SSL pending or TLS pending.
3. Choose the coverage. Decide whether the certificate needs to cover one domain, related subdomains, or several domains. 
4. Choose the validation level. Select domain validation, organization validation, or extended validation. 
5. Use a certificate authority. When your platform or host issues the certificate, follow its setup steps. For a manual setup, choose a certificate authority and generate a certificate signing request, or CSR. The CSR includes your domain details and public key.
6. Verify and install the certificate. Complete the certificate authority’s verification steps. Then install the certificate through your host, server, or admin console. Generate a new private key during setup.
7. Confirm HTTPS is working. Open your site in a browser and check for HTTPS in the address bar. For Shopify stores, the domain status should show as Connected, and the padlock should appear next to the store URL.
8. Check external assets. Make sure images, videos, webfonts, and scripts load over HTTPS. Pages can appear insecure when external assets still load over HTTP.