SSL Certificates: How to Protect Your Website

Every time you log in, fill out a form or make a purchase, a private conversation is happening between your browser and a website. An SSL certificate is what keeps that conversation secure and doesn't your personal data get leaked.

Having an SSL for your website is important on multiple levels, including safety, speed, and SEO.

What Is an SSL Certificate?

An SSL, or Secure Sockets Layer, certificate is a document that proves a website’s security. It is a sign that the connection is encrypted and safe, and a website isn’t a scam. You can see that a website has an SSL if its address is preceded by https://. If there is an http:// — it means that a website is not protected.

Right now browsers actually use SSL’s successor, TLS, but most people still refer to the certificates as SSL.

So, SSL has two main purposes:

How SSL Works

When you visit a website, your browser performs a certificate validation. Then, it checks that it is issued by a trusted source and belongs to the domain you’re trying to access.

Once the certificate is checked, your browser and the website create a shared session key. A shared session key is a password that is only visible to the browser and the website. The purpose of it is to make sure that no one can see your passwords, payment details, or other personal information.

With SSL everything you send to the website is encrypted. Anyone trying to intercept the connection only sees unreadable data. The UK National Cyber Security Centre confirms that HTTPS prevents attackers on the same network from reading or altering information in transit.

SSL certificates last from one to two years and must be renewed regularly. The maximum allowed lifetime was reduced to 398 days following decisions recorded by the CA/Browser Forum.

Types of SSL Certificates

All SSL certificates have encryption, but they differ in how thoroughly the issuing authority checks the website owner’s identity. There are three main certificates — Domain Validation, Organisation Validation, and Extended Validation. We’ll explain for which cases each one of them is best for:

SSL types

What Happens if You Don’t Have SSL?

In short, your website becomes less trustworthy for browsers without SSL. In July 2018, Google Chrome began marking all http sites as not secure. Other browsers followed the example — Microsoft Edge, Firefox, Safari and Opera all warn users not to go on websites without SSL. Browsers can block parts of a page if they detect “mixed content”—when a secure https page loads some elements over insecure http. Chrome’s security engineering team states this policy in its public documentation, noting that mixed content may be blocked or automatically upgraded.

How it looks when a website doesn't have SSL

Likewise, payment systems rely on the encrypted connection. PCI Security Standards Council states that payment pages must use strong encryption. Without it, online payment processing is not allowed.

Search engines also take SSL into account. Google confirmed externally that it is used as a ranking factor for search results. Unsecured sites with http have their visibility lowered.

Moreover, the main global web standards body of the W3C requires SSL for geolocation, service workers for progressive web apps and access to cameras and microphones. Otherwise these features do not function.

The lack of SSL poses a risk to your visitors. When a site is http, data travels as readable text. Attackers on the same Wi-Fi network can intercept usernames, passwords and personal information using “man-in-the-middle” techniques. Without SSL, it is much easier to do for them.

Where to Get SSL Certificates

You can get SSL certificates from a lot of sources, including dedicated certificate providers, hosting companies and some non-profit organisations.

SSL + Hosting

One of the most convenient ways to get an SSL certificate for your website is with hosting. A reliable global solution would be Ultahost, as it has all three types of SSL available, while also offering packages with warranties for projects of different scale.

A certificate can be replaced for free if you need to switch servers, or change a domain name. Ultahost gets its SSL from reliable providers, such as GeoTrust, DigiCert and RapidSSL.

Free SSL

Free certificates by Let’s Encrypt, a non-profit backed by academic and public-interest organisations, are enough for small websites. Its technical standards are publicly documented through the Internet Security Research Group.

SSL Providers

You can also purchase an SSL directly from certificate providers mentioned before:

It makes sense if you need maximum control and run a big enterprise. Getting an SSL from a hosting provider can turn out to be cheaper when you want basic security, because hosting plans include SSL certificates for free. It’s true not only for hosting services, but website building platforms. All domains on Site.pro are protected by SSL even on the free plan.