An SSL certificate is a digital file that verifies a website's identity and encrypts the connection between a server and a visitor's browser. It is the technology behind the padlock icon and the "https" in a web address. Hosting providers sell it because every browser checks for one before trusting a site.
This guide covers how an SSL certificate works, the certificate types available, how to get one for free or paid, and what happens without one.
Why Do You Need an SSL Certificate?
An SSL certificate secures a website five ways: encryption, browser trust, identity verification, search visibility, and payment compliance. Each benefit addresses a different risk of running a site without one.
- Encryption: an SSL certificate scrambles data in transit, so a network eavesdropper cannot read passwords, card numbers, or form submissions.
- Browser trust: browsers show a padlock and "https" for a valid certificate. Without one, Chrome and other browsers flag the page "Not Secure."
- Identity verification: the certificate proves a server actually controls its domain, which blocks attackers from spoofing your site with a convincing fake.
- Search visibility: Google confirmed HTTPS as a ranking signal in 2014, giving encrypted sites a small edge in search results.
- Payment compliance: any site taking card payments needs SSL to meet PCI DSS, the security standard card networks require for handling cardholder data.
A hosting plan's SSL support pairs with another core reliability signal: what is uptime. Both metrics are the trust signals hosting providers lead with in their marketing.
How Does an SSL Certificate Work?
An SSL certificate works through a Certificate Authority, a public and private key pair, and a "handshake" that negotiates an encrypted session. That exchange happens before any page content actually loads.
The server first generates a Certificate Signing Request (CSR) from its key pair. It sends the CSR to the Certificate Authority, which verifies the site's identity and signs the certificate.
A certificate authenticates the server, not the address a visitor types. What is a domain name covers how a domain points visitors to the right server. What is dns resolution translates that domain into an IP address before any handshake begins.
The full handshake runs in four steps, per Wikipedia's TLS documentation.
- The client sends a "hello" listing the encryption methods it supports.
- The server replies with a "hello," picking one cipher and sending its certificate.
- The client validates the certificate against a trusted Certificate Authority.
- Both sides exchange keys, agree on a temporary session key, and start the encrypted session.
What Types of SSL Certificates Are There?
SSL certificates are grouped two ways: by validation level (how deeply the authority checks identity) and by domain coverage (how many names one certificate secures). Every certificate combines one choice from each group.
By validation level, certificates split into three tiers, DV, OV, and EV, each checking a different depth of identity before issuing.
| Certificate Type | Validation Depth | Typical Use Case | Issuance Time |
|---|---|---|---|
| DV (Domain Validated) | Confirms only domain ownership | Blogs, informational sites | Minutes |
| OV (Organization Validated) | Confirms domain ownership and business identity | Login pages, business sites | 1 to 3 days |
| EV (Extended Validation) | Confirms domain, business, and legal registration | Checkout pages, financial sites | Days to weeks |
A DV certificate proves the least. DigiCert notes that phishing sites routinely carry a padlock and a DV certificate, since domain-only validation catches no fraud. OV and EV certificates add a real identity check a browser cannot fake.
A certificate's price and issuance speed follow this same validation depth. Let's Encrypt issues DV certificates for free through automation. OV and EV certificates, by contrast, come only from paid, commercial Certificate Authorities such as DigiCert or Sectigo.
By domain coverage, a certificate secures one exact name, one domain plus its subdomains, or several separate domains at once.
| Coverage Type | What It Secures | Example |
|---|---|---|
| Single-domain | One fully qualified domain name | example.com |
| Wildcard | A domain and unlimited first-level subdomains | *.example.com |
| Multi-domain (SAN or UCC) | Several distinct domains on one certificate | example.com, example.net |
Some sites terminate their certificate at the network edge instead of the origin server. See the what is a cdn guide for how a CDN manages TLS on the site's behalf.
How Do You Get an SSL Certificate?
A site gets an SSL certificate through one of three paths, based on budget and validation needs.
- Free, automated issuance: Let's Encrypt and ZeroSSL both issue free DV certificates through ACME automation, the path most hosting plans bundle by default. Let's Encrypt alone secures more than 700 million websites this way, according to its own published figures.
- Paid issuance from a commercial CA: a site needing OV or EV validation buys a certificate from a CA such as DigiCert or Sectigo, verified manually.
- Hosting-included provisioning: many hosting accounts auto-provision a free certificate for every domain added through tools like cPanel AutoSSL, with no manual request needed.
What Happens If You Don't Have an SSL Certificate?
A site without an SSL certificate shows every visitor a "Not Secure" warning in the browser's address bar. Any data submitted, including passwords and payment details, travels in plain text and can be intercepted.
Search engines also rank unencrypted sites lower, per Fortinet's cybersecurity glossary, and visitors who see the warning often leave before completing a purchase. A partial fix creates its own problem: mixed content.
Mixed content happens when an HTTPS page still loads some resources over plain HTTP, a common mistake during partial SSL adoption. Per MDN Web Docs, browsers auto-upgrade safe resources like images to HTTPS automatically. They block riskier resources, such as scripts and stylesheets, until every resource on the page loads securely.
How MaxHost Helps You Sell SSL Certificates as a Hosting Upsell
MaxHost does not issue or provision SSL certificates itself, since that is a hosting account and Certificate Authority function. What it gives a hosting reseller is the pricing-table and plan-comparison UI needed to market SSL as an included feature or a paid upsell.
A hosting reseller running MaxHost gets ready-made pricing tables and multi-plan comparison blocks out of the box. Each plan row can list "Free SSL included" or "SSL upgrade available" without any custom development, since the components ship with the theme.
A reseller building this pricing page from scratch can follow the how to make a web hosting website guide for the full walkthrough.
FAQs
What is an SSL certificate?
An SSL certificate is a digital file that verifies a website's identity and encrypts the connection between a server and a visitor's browser. It is the technology behind the padlock icon and "https" in a web address.
Is SSL the same as TLS?
SSL and TLS are not exactly the same. SSL is the original, now-obsolete protocol; TLS is its modern successor and the protocol every current certificate actually uses. "SSL certificate" remains the common industry name for what is technically a TLS certificate.
Is a free SSL certificate as secure as a paid one?
A free SSL certificate encrypts data exactly as strongly as a paid one. The encryption strength is identical. What a paid OV or EV certificate adds is verified organization identity, information a free DV certificate from Let's Encrypt does not check.
Can a website use HTTPS without an SSL certificate?
No, a website cannot serve HTTPS without an SSL certificate. The certificate is the "S" in HTTPS, since it supplies the keys that establish the encrypted connection. Without one, the browser falls back to plain, unencrypted HTTP.
How long does an SSL certificate last?
A publicly trusted SSL certificate currently lasts a maximum of 200 days, down from the 398-day limit allowed before March 2026. That maximum drops again to 100 days in March 2027, then to 47 days in March 2029. Free certificates from Let's Encrypt renew automatically through ACME, so this shrinking window rarely requires manual action.