What is an SSL certificate and why does your website absolutely need one?

What is an SSL certificate and why your site absolutely needs one

An SSL certificate is a digital credential that establishes an encrypted HTTPS connection between a visitor's browser and your web server, while also confirming your website's identity. In practice, that means a padlock icon in the address bar, a URL that starts with https://, and protection against data being intercepted in transit. For website owners, it means even more: websites without an SSL certificate risk being flagged by browsers with a "Not secure" warning, which directly affects visitor trust and bounce rate.

• The padlock and HTTPS: a visible sign that the connection is encrypted and verified.
• Data protection: all data between the browser and the server is encrypted, preventing interception.
• Trust and conversions: visitors who see an unsafe-site warning leave in most cases right away.

Expert tip: Before checking anything else on your website, look at the address bar to see whether the URL starts with https://. That's the fastest way to tell whether a certificate is installed and active.

Table of contents

• How an SSL certificate works: encryption, keys, and the TLS handshake
• How to check a certificate in your browser and what warnings mean
• Which types of SSL certificates exist, and when to choose the right one?
• Why is an SSL certificate key to security, trust, and SEO?
• How to get and install an SSL certificate in Slovenia?
• What to do when a certificate expires or the browser shows an error?
• Why is certificate maintenance just as important as installation?
• Key takeaways
• My take on SSL certificates and an often overlooked truth
• Moxy-web handles secure and reliable HTTPS configuration
• Useful resources for further reading
• Frequently asked questions

How an SSL certificate works: encryption, keys, and the TLS handshake

Although the term "SSL" has stuck in everyday language, modern protocols today actually run as TLS - specifically TLS 1.2 and TLS 1.3. The old SSL 2.0 and SSL 3.0 versions are outdated and unsafe, so no serious server supports them anymore. So when you buy an "SSL certificate," what you're actually getting is a credential from a certificate authority (CA) that your server uses to establish a TLS session.

Security rests on two keys: a public key, which is publicly accessible and used by the browser to encrypt initial messages, and a private key, which stays exclusively on the server and is the only one able to decrypt those messages. Once the session is established, both ends switch to symmetric encryption using a one-time session key, which is significantly more computationally efficient.

The SSL/TLS handshake is that invisible step where trust gets established: the browser checks the certificate, confirms the issuer, and performs a key exchange before any data is transferred.

The process runs in four steps:

• Hello (ClientHello/ServerHello): the browser and server agree on the TLS version and encryption algorithms.
• Certificate verification: the browser checks the certificate's validity and trusts the CA that signed it.
• Key exchange: the session key is securely exchanged using asymmetric encryption.
• Session established: all further communication uses symmetric encryption.

A technical detail every provider needs to know: SNI (Server Name Indication) is a TLS extension that tells the server which certificate to send when multiple domains are hosted on the same IP address. Without proper SNI configuration, visitors see the wrong certificate or get an error.

Expert tip: When setting up a server, always check whether your host supports SNI. Most modern providers support it automatically, but with older configurations this is a common source of errors.

The modern TLS 1.3 handshake requires fewer steps than TLS 1.2, making it not just more secure but also faster. For visitors, that means less time until the first content appears on the page.

How to check a certificate in your browser and what warnings mean

Checking a certificate in your browser takes less than a minute and tells you all the key information about the connection's security.

1. Click the padlock icon (or the "i" in a circle) to the left of the URL in the address bar.
2. Select "Connection is secure" or "Certificate is valid."
3. Check the issuer's name (CA), the expiration date, and which domain the certificate was issued for.
4. With EV certificates, you'll also see the organization's name.

The most common warnings and what they mean:

• "Certificate has expired": the validity date has passed; the browser blocks access or shows a red warning.
• "Wrong domain": the certificate was issued for a different domain, often the result of an improper installation or a forgotten certificate for a subdomain.
• "Self-signed certificate": a self-signed certificate encrypts traffic but doesn't confirm the server's identity, and browsers flag it as untrustworthy.
• "Revoked certificate": the CA has revoked the certificate, which is a serious security signal.

A "Not secure" warning in the browser isn't just a cosmetic issue. For a visitor, it's a clear sign that the site isn't reliable, and most will leave the site immediately.

A quick diagnostic checklist for site owners: check the expiration date, confirm that the certificate covers the right domain (including www), check that the full certificate chain (intermediate CA) is installed, and run a test with the SSL Labs tool.

Which types of SSL certificates exist, and when to choose the right one?

Certificates differ in how thoroughly they verify identity and in how many domains they cover.

A DV certificate only verifies domain ownership, while OV and EV require additional checks on the company and thereby provide a higher level of trust. For an ordinary brochure site or blog, a DV certificate is entirely sufficient. An online store that processes payments deserves at least OV, ideally EV, since visitors see the verified organization name in the address bar.

• A wildcard certificate covers a domain and all of its subdomains (*.yourdomain.si), which makes sense when you have separate subdomains for a blog, a store, or an app.
• A SAN certificate covers several entirely different domains with a single certificate, which simplifies management for larger projects.

Expert tip: If you run an online store in Slovenia, check your payment provider's requirements. Some require at least an OV certificate to ensure compliance with secure payment processing standards.

Why is an SSL certificate key to security, trust, and SEO?

The security value of a certificate is direct: encryption prevents "man-in-the-middle" attacks, where an attacker could intercept or alter data in transit. Without HTTPS, login credentials, addresses, card numbers, and all other sensitive content are visible to anyone monitoring the network.

Visitor trust is measurable too. Websites without an SSL certificate risk losing up to 85% of visitors the moment the browser shows an unsafe-site warning. This directly affects conversion rate, time on site, and, in the long run, revenue.

The SEO benefit is well documented: Google treats HTTPS as a positive ranking signal. HTTPS also enables the use of the HTTP/2 protocol, which speeds up page loading by transferring resources in parallel. A faster site means a better user experience and better search rankings, which is why the importance of HTTPS goes beyond just security.

From a data protection law perspective, an SSL certificate is a prerequisite for lawfully collecting any personal data through web forms. The GDPR requires appropriate technical measures to protect data, and HTTPS is one of the fundamental ones.

Note: this article is general information and doesn't replace legal or professional advice. For specific compliance requirements, consult a professional.

How to get and install an SSL certificate in Slovenia?

Getting a certificate today is significantly simpler than it used to be, but it still requires precision at every step.

1. Choose the type of certificate based on your site type and the level of verification you need.
2. Obtain the certificate: through your host (many include it in the package), through your domain registrar, or free through Let's Encrypt.
3. Generate a CSR (certificate signing request) on the server or through your host's control panel.
4. Confirm domain ownership: for DV certificates, through email, a DNS record, or a file on the server.
5. Install the certificate on the server and configure a redirect for all HTTP requests to HTTPS.
6. Verify the installation using SSL Labs or a similar test tool.

For Slovenian businesses, the most common route is working with a domestic host who includes the certificate in the hosting package or installs it on request. Let's Encrypt is an excellent free solution for brochure sites, but it requires automated renewal every 90 days. A common mistake with a DIY installation is forgetting to redirect HTTP to HTTPS, or missing intermediate certificates (intermediate CA), which causes errors in some browsers.

Expert tip: After installing a certificate, always check that all internal links and resources (images, scripts, fonts) load over HTTPS. Mixed content undermines the security signal and triggers browser warnings.

What to do when a certificate expires or the browser shows an error?

An expired certificate triggers security warnings and can block access to the site, which means immediate business damage. Quick diagnosis is essential.

• Check the certificate's expiration date in the browser or through SSL Labs.
• Confirm the certificate covers the right domain (including www and any subdomains you need).
• Check that the full certificate chain (root CA + intermediate CA) is installed.
• Check the SNI configuration if multiple domains are hosted on the same IP address.

Once a certificate expires, act immediately:

1. Renew the certificate with your provider or through Let's Encrypt.
2. Install the new certificate on the server and restart the web server.
3. Check that redirects are set up correctly.
4. Confirm everything works with an independent test tool.

If you can't fix the error yourself, it's time to call your host or developer. Errors involving missing intermediate certificates, incorrect SNI configuration, or revoked certificates require access to server settings that a site owner often doesn't have.

Why is certificate maintenance just as important as installation?

A certificate isn't a one-time setting. Security isn't "set it and forget it": automated renewal and regular monitoring of certificates prevent sudden outages and loss of customer trust. Let's Encrypt certificates expire every 90 days, while commercial ones expire annually, and both require active monitoring.

Companies without a system in place to alert them when a certificate is about to expire risk their site becoming inaccessible overnight. A single incident like that can wipe out months of customer trust built up over time.

Recommended practices for reliable management:

• Set up automated renewal (e.g. through Certbot for Let's Encrypt, or through a host that supports it).
• Set up email alerts at least 30 days before a certificate expires.
• Run a configuration test after every installation or renewal.
• Keep a record of your certificates: domain, type, expiration date, provider.

For businesses with multiple domains or more complex infrastructure, centralized certificate management from an experienced agency is a worthwhile investment. One late renewal or misconfiguration costs more than a year's worth of maintenance service. You can find out more about how to manage business website security without risk on the Moxy-web blog.

Expert tip: Set a calendar reminder 45 days before your certificate expires. If you have automated renewal, manually verify it works correctly at least once a year.

Key takeaways

An SSL certificate is the foundation of any reliable website: without one, you risk losing access, losing visitor trust, and dropping in search rankings.

My take on SSL certificates and an often overlooked truth

Most discussions about SSL certificates stop at "install it and forget about it." That's the wrong approach, and I see it at a surprisingly large share of business websites. A certificate is a living part of your infrastructure that deserves the same attention as any other critical component.

What genuinely bothers me is the belief that a free certificate is always enough. For a personal blog, Let's Encrypt is a great solution. But for a company that collects inquiries, sells, or communicates with customers through its website, the question of a certificate's value is framed wrong. The real question is: how much does one day of downtime, or one security warning in a browser at a critical moment, actually cost?

I also often see companies install a certificate but forget to redirect HTTP to HTTPS, forget about mixed content, or get the certificate chain wrong. Technically, they have a certificate, but its security value is incomplete. Testing after installation isn't a luxury - it's a mandatory step.

My recommendation is simple: treat a certificate as part of regular website maintenance, not a one-off task. Companies that understand this have fewer outages, better conversions, and fewer technical crises at the wrong time.

Moxy-web handles secure and reliable HTTPS configuration

Installing a certificate is just the first step. Moxy-web provides the complete process for businesses in Slovenia: from choosing the right type of certificate and installation, through to automated renewal and regular validity monitoring. The difference compared to a DIY installation is reliability: no forgotten deadlines, no errors from missing intermediate certificates, and no unpleasant surprises when something expires.

For companies managing multiple domains or online stores, Moxy-web provides centralized management and technical support with clear accountability. The certificate is part of a broader package of secure hosting and maintenance, meaning you focus on your business while we handle the technical side.

Find out how Moxy-web can help you with a secure and reliable online presence at moxy-web.com.

Useful resources for further reading

• How TLS/SSL works (Pentester.si) - an in-depth look at the TLS protocol and SNI configuration.
• What is an SSL certificate, FAQ (NiceNIC) - a reference guide for generating a CSR and activating a certificate.
• A guide to a secure business website (Moxy-web) - step-by-step tips for business website security.
• Security trends for business web systems (Moxy-web) - an analysis of current security trends for enterprise web solutions.

Frequently asked questions

What is an SSL certificate and do I need one?

An SSL certificate is a digital credential that encrypts the connection between a browser and a server and confirms a website's identity. Any website that collects data or wants to maintain visitor trust needs one.

What's the difference between a free and a paid certificate?

Let's Encrypt provides a free DV certificate suitable for most brochure sites. Paid OV and EV certificates include verification of the company's identity and are recommended for online stores and portals handling sensitive data.

What happens when an SSL certificate expires?

Browsers immediately show a security warning and block or restrict access to the site, causing a drop in traffic and a loss of visitor trust.

How long does it take to get an SSL certificate?

A DV certificate (including Let's Encrypt) becomes active within minutes to hours. An OV certificate takes 1-3 days, and EV takes 3-7 days due to more thorough verification.

Does an SSL certificate affect Google rankings?

Yes, Google treats HTTPS as a positive ranking signal. HTTPS also enables the use of HTTP/2, which speeds up page loading and indirectly improves search rankings.

Recommended

• Moxy Web - Why use an SSL certificate for a secure website
• Moxy Web - Let's build a better web.
• Moxy Web - Company website security without illusions
• Moxy Web - Company web security without empty promises