An SSL certificate does two things for a website:
- It encrypts. What visitors send you — passwords, card details, a contact form — can't be read on the way.
- It identifies. The certificate is signed by a certificate authority, which checked that whoever asked for it controls the domain.
Browsers show the padlock when both hold. Click it to read the certificate: who it was issued to, who issued it, and when it expires.
What it does not do
Important
A certificate does not make a website secure. It protects the connection, not the site. A hacked site with a valid certificate is still hacked — see Website protection for that.
Types
| Type | Covers | Checks |
|---|---|---|
| Domain validated | One domain name | That you control the domain. Issued within minutes |
| Wildcard | A domain and all its subdomains — *.yourdomain.com | The same check, one certificate for every subdomain |
| Extended validation (EV) | One domain, with your organisation's identity verified | A manual check of the legal existence of your business. Takes days |
Domain validated is right for most sites: the encryption is identical. Wildcard makes sense once you run several subdomains. EV is bought where the visible identity of the business matters to customers.