SSL Certificate Basics

What SSL Does

SSL certificates, more accurately TLS certificates, let browsers verify they are talking to the right site and encrypt traffic between visitor and server.

Without HTTPS, visitors see warnings, logins are unsafe, forms are exposed, and search engines treat the site as lower quality.

Let's Encrypt Is Usually Enough

For most websites, a free Let's Encrypt certificate is completely fine. It provides the same browser-trusted encryption as paid domain-validated certificates.

Paid certificates can still make sense for specific compliance requirements, organisation validation, extended validation, or support contracts, but they are not inherently more encrypted.

Common Certificate Problems

The most common failures are expired certificates, DNS pointing to the wrong server, HTTP validation blocked by redirects or firewalls, missing intermediate certificates, and mixed content.

Mixed content happens when the page loads over HTTPS but images, scripts, styles, or iframes still use HTTP URLs.

Wildcard Certificates

Wildcard certificates cover all first-level subdomains, such as *.example.com. They are useful when you create many subdomains or want one certificate for multiple services.

They usually require DNS validation, which means the certificate issuer verifies control through DNS records rather than a web server file.

Renewal

Automatic renewal is essential. Certificates expire, and manual renewal will eventually be forgotten.

On VPS servers, Certbot, acme.sh, Caddy, and many control panels can automate renewal. The important part is monitoring. A renewal job can fail silently if DNS, firewalls, or web server configuration changes.

Verdict

Use HTTPS everywhere, automate renewal, and monitor expiry. For most sites, Let's Encrypt is the right certificate choice.

For the full security picture, see [SSH Hardening](/guides/ssh-hardening) and [Server Monitoring Basics](/guides/server-monitoring-basics).