Servers & HostingAdvanced

What Is an SSL Certificate? Complete Guide to SSL/TLS, HTTPS, Encryption, Website Security, Types, Installation, Validation, and Troubleshooting

An SSL certificate is a digital certificate used to establish an encrypted and authenticated connection between a user's device and a website or server. When...

Bison Technical Team Enterprise IT specialists

Updated 30 Aug 2026 21 min read 0 total views

An SSL certificate is a digital certificate used to establish an encrypted and authenticated connection between a user's device and a website or server.

When a website is protected by a valid SSL/TLS certificate, its address normally starts with:

https://

instead of:

http://

For example:

HTTP: http://example.com

HTTPS: https://example.com

The additional S in HTTPS means Secure.

An SSL certificate helps protect information transmitted between a browser and a web server from being easily read or modified by unauthorized parties while it is travelling across a network.

Common information protected by HTTPS includes:

Usernames and passwords
Contact form information
Customer information
Payment-related information
Session cookies
Login tokens
Search queries
API requests and responses
Business application data
Personal information transmitted through websites

Although the term SSL certificate remains widely used, modern secure websites actually use TLS (Transport Layer Security) rather than the obsolete SSL protocols.

Therefore, certificates commonly marketed as "SSL certificates" today are technically SSL/TLS certificates or TLS certificates.

What Does SSL Stand For?

SSL stands for:

Secure Sockets Layer

SSL was developed to provide encrypted communications over computer networks.

Several SSL versions existed historically, but SSL itself is now obsolete because of known security weaknesses.

Modern systems use TLS — Transport Layer Security.

The progression was broadly:

SSL 2.0 → SSL 3.0 → TLS 1.0 → TLS 1.1 → TLS 1.2 → TLS 1.3

TLS 1.2 and TLS 1.3 are the versions most relevant to modern systems.

Despite this change, terms such as the following remain extremely common:

SSL certificate
Buy SSL
Install SSL
SSL renewal
SSL error
SSL checker
SSL configuration

In most modern contexts, these actually refer to TLS certificates and TLS-secured connections.

What Is HTTPS?

HTTPS stands for:

Hypertext Transfer Protocol Secure

HTTPS is essentially HTTP communication protected using TLS.

A simplified representation is:

HTTP + TLS = HTTPS

HTTP alone does not provide transport encryption.

HTTPS provides a protected communication channel between the client and server.

For example:

Browser → Encrypted HTTPS Connection → Web Server

instead of:

Browser → Unencrypted HTTP Connection → Web Server

Why Is an SSL Certificate Important?

An SSL/TLS certificate provides three major security functions.

1. Encryption

Data transmitted between the browser and server is encrypted.

If an attacker captures encrypted network traffic, the information should not be directly readable without the appropriate cryptographic secrets.

This is especially important when transmitting:

Passwords
Authentication tokens
Customer information
Payment information
Confidential business data
API credentials
Session cookies

2. Authentication

The certificate helps the browser verify that it is communicating with the server associated with the requested domain.

For example, if you open:

https://www.example.com

the browser checks whether the presented certificate is valid for www.example.com.

This helps reduce the risk of users unknowingly establishing encrypted connections with unauthorized servers.

3. Integrity

TLS provides mechanisms that help detect whether transmitted information has been altered during communication.

Therefore, TLS is designed to provide:

Confidentiality + Authentication + Integrity

These are fundamental security requirements for Internet communication.

How Does an SSL Certificate Work?

The underlying process is sophisticated, but it can be understood through several major stages.

Suppose a user visits:

https://example.com

Step 1: Browser Connects to the Server

The user's browser requests a secure connection to the web server.

HTTPS commonly uses TCP port:

443

Step 2: Server Presents Its Certificate

The server sends its SSL/TLS certificate and related certificate-chain information to the browser.

The certificate contains information such as:

Domain name
Certificate issuer
Certificate validity period
Public key
Digital signature
Certificate serial number
Supported identity information

Step 3: Browser Validates the Certificate

The browser performs several checks.

It may verify:

Is the certificate within its validity period?
Is it valid for the requested hostname?
Was it issued through a trusted certificate chain?
Has the certificate been revoked, where applicable?
Are the cryptographic algorithms acceptable?
Can the certificate chain be validated to a trusted root?

If validation succeeds, the TLS connection can continue.

Step 4: Cryptographic Keys Are Established

The client and server perform a TLS handshake.

Modern TLS commonly uses asymmetric cryptography and ephemeral key-exchange mechanisms to securely establish shared session secrets.

Step 5: Symmetric Encryption Protects the Session

Once session keys are established, bulk communication is protected using efficient symmetric cryptography.

A simplified representation is:

Browser ⇄ Encrypted TLS Session ⇄ Web Server

What Is the SSL/TLS Handshake?

The TLS handshake is the negotiation process performed before normal encrypted application data is exchanged.

Depending on the TLS version and configuration, the handshake establishes or determines:

TLS protocol version
Cryptographic algorithms
Server identity
Certificate validation
Key-exchange parameters
Shared session keys

TLS 1.3 significantly simplified and improved parts of the handshake compared with older protocol versions.

Public Key and Private Key

SSL/TLS certificates use public-key cryptography.

A server normally has a key pair:

Public Key

The public key can be distributed publicly and is included or represented through the certificate.

Private Key

The private key must remain confidential and should stay under the control of the certificate owner/server.

A critical security principle is:

Never publicly share your SSL/TLS private key.

If an unauthorized person obtains a server's private key, security may be seriously compromised depending on the protocol configuration and circumstances.

What Is a Certificate Authority?

A Certificate Authority (CA) is an organization that issues and signs digital certificates.

Examples of well-known certificate authorities or certificate providers include:

DigiCert
Sectigo
GlobalSign
Let's Encrypt
Entrust
GoDaddy

Operating systems and browsers maintain trusted root certificate stores.

When a website presents its certificate, the browser attempts to establish a chain from the website certificate through intermediate certificates to a trusted root certificate.

What Is the Certificate Chain of Trust?

Certificates normally form a hierarchy.

A simplified certificate chain looks like:

Root CA Certificate
↓
Intermediate CA Certificate
↓
Website/Server Certificate

The server certificate is usually not signed directly by the root certificate. Instead, one or more intermediate certificates are commonly involved.

This structure is called the:

Certificate Chain

or:

Chain of Trust

If the server fails to provide the required intermediate certificate, some clients may report certificate trust or chain errors.

What Information Does an SSL Certificate Contain?

An X.509 server certificate may contain information including:

Subject information
Subject Alternative Names (SANs)
Issuer
Public key
Serial number
Valid-from date
Valid-until date
Signature algorithm
Key usage
Extended key usage
Digital signature
Certificate policies

For modern HTTPS certificates, hostname identities are primarily represented using the Subject Alternative Name (SAN) extension.

Types of SSL Certificates

SSL/TLS certificates can be categorized by validation method and by the number/type of hostnames they protect.

1. Domain Validation (DV) Certificate

A DV certificate verifies control over a domain name.

The certificate authority may verify control through mechanisms such as:

DNS records
HTTP validation
Other approved domain-control methods

DV certificates are widely used for:

Blogs
Informational websites
Small business websites
Web applications
Personal websites

DV validates domain control; it does not mean the CA has extensively verified the organization operating the site.

2. Organization Validation (OV) Certificate

An OV certificate involves validation of domain control plus organizational information according to the CA's validation procedures.

It may be appropriate for:

Corporate websites
Business portals
Customer-facing applications
Organizational services

3. Extended Validation (EV) Certificate

EV certificates require more extensive organizational validation according to applicable certificate-industry requirements.

Modern browsers generally do not display the highly prominent company-name indicators historically associated with EV certificates.

Therefore, organizations should not purchase EV solely expecting the old-style browser address-bar display.

Certificates by Domain Coverage

Another way to classify certificates is according to the hostnames they protect.

Single-Domain Certificate

Protects specific hostname identities included in the certificate.

For example:

www.example.com

The exact coverage depends on the SAN entries contained in the certificate.

Wildcard SSL Certificate

A wildcard certificate can protect multiple first-level subdomains of a domain.

For example:

*.example.com

may cover:

mail.example.com
shop.example.com
support.example.com
portal.example.com

However, wildcard matching has limitations and does not automatically cover every possible nested hostname.

For example:

*.example.com

generally does not match:

server.office.example.com

Multi-Domain or SAN Certificate

A multi-domain certificate can protect multiple hostname identities using Subject Alternative Names.

For example:

example.com
www.example.com
example.net
portal.example.org

This is useful when multiple domains or hostnames need to be secured using one certificate.

What Is a CSR?

CSR stands for:

Certificate Signing Request

A CSR is generated when requesting a certificate from a certificate authority.

The CSR contains information needed for the certificate request, including the corresponding public key and requested identity information.

A simplified process is:

Generate Private Key → Generate CSR → Submit CSR to CA → Complete Validation → CA Issues Certificate → Install Certificate

The private key should remain securely stored and should not be sent to the CA as part of a normal CSR submission.

What Is a Self-Signed Certificate?

A self-signed certificate is signed by its own private key rather than being issued through a publicly trusted CA hierarchy.

Self-signed certificates can still provide encryption.

However, browsers and operating systems normally do not automatically trust them.

Users may therefore receive warnings such as:

Your connection is not private

Self-signed certificates can be useful in controlled environments such as:

Development systems
Testing environments
Internal applications
Laboratories
Private infrastructure

For managed internal environments, organizations can also deploy their own private certificate authority and install its root certificate on managed devices.

SSL Certificate vs HTTPS

SSL/TLS and HTTPS are related but are not identical.

SSL/TLS provides the cryptographic communication security.

HTTPS is HTTP transmitted through TLS.

Therefore:

HTTPS uses TLS to secure web communication.

Installing a certificate alone may not automatically mean that every website request uses HTTPS. The web server and application must also be correctly configured.

HTTP vs HTTPS

Feature	HTTP	HTTPS
Encryption	No TLS encryption	TLS encryption
Typical Port	80	443
Certificate	Not required	Required for authenticated HTTPS
URL	http://	https://
Data protection in transit	Limited	Encrypted
Browser security indicator	May show insecure	Secure connection when correctly configured

HTTPS should be used for essentially all modern public websites, not only banking or e-commerce websites.

SSL vs TLS

SSL and TLS are often used interchangeably in everyday terminology, but technically they are different protocol generations.

SSL: Obsolete predecessor.

TLS: Modern replacement.

Therefore, when a hosting provider says:

Install SSL Certificate

it normally means:

Install and configure a certificate for TLS/HTTPS.

What Is TLS 1.2?

TLS 1.2 remains widely supported and can provide strong security when properly configured with modern cipher suites and cryptographic parameters.

Many enterprise applications continue to support TLS 1.2 for compatibility.

What Is TLS 1.3?

TLS 1.3 is a newer TLS version designed to improve security and efficiency.

Benefits include:

Simplified handshake
Removal of many obsolete cryptographic options
Strong modern cryptographic design
Reduced handshake latency in many situations
Mandatory forward-secret key exchange in standard TLS 1.3 cipher suites

Modern servers should generally support TLS 1.3 where practical while retaining TLS 1.2 when compatibility requires it.

What Happens When an SSL Certificate Expires?

Certificates have limited validity periods.

When a certificate expires, browsers may display warnings such as:

Your connection is not private

or:

Certificate expired

Users may be discouraged or prevented from visiting the website.

Certificate expiry can affect:

Websites
APIs
Mobile applications
Email services
VPN services
Remote-access gateways
Internal applications
Payment integrations

Certificate renewal should therefore be automated wherever practical.

Common SSL Certificate Errors

1. Certificate Expired

The certificate validity period has ended.

Solution: Renew or replace the certificate and verify that the new certificate is actually being served.

2. Hostname Mismatch

The requested hostname is not covered by the certificate.

For example, the certificate may cover:

example.com

while the user visits another hostname that is not included in its SAN list.

Solution: Obtain or configure a certificate that includes every required hostname.

3. Certificate Not Trusted

The client cannot establish a valid chain to a trusted certificate authority.

Possible causes include:

Self-signed certificate
Missing intermediate certificate
Unknown CA
Incorrect certificate chain

4. Incomplete Certificate Chain

The web server is not supplying the appropriate intermediate certificate chain.

This can cause the website to work on some devices but fail on others.

5. Mixed Content

A website may load the main page through HTTPS but still load certain resources using HTTP.

Examples include:

Images
JavaScript
CSS
Embedded content

Browsers may block or warn about insecure mixed content.

6. Incorrect Server Time

Certificate validation depends on time.

If a device's date and time are seriously incorrect, valid certificates may appear expired or not yet valid.

7. Wrong Certificate Installed

A server hosting multiple websites may present the wrong certificate because of incorrect virtual-host or TLS configuration.

Server Name Indication (SNI) configuration can be relevant in multi-site environments.

Does SSL Protect a Website From Hackers?

Not by itself.

This is a very important distinction.

SSL/TLS protects data in transit between endpoints.

It does not automatically protect a website from:

Malware
SQL injection
Cross-site scripting
Weak passwords
Compromised administrator accounts
Vulnerable plugins
Unpatched software
Server misconfiguration
Malicious file uploads
Application vulnerabilities
Ransomware

Therefore:

HTTPS does not mean that a website itself is trustworthy or malware-free.

Even a malicious website can obtain a valid TLS certificate for a domain it controls.

A secure website requires multiple security layers.

Does the Padlock Mean a Website Is Safe?

A browser's secure-connection indicator primarily means that the connection is encrypted and the certificate passed the browser's validation checks for the requested site.

It should not be interpreted as proof that:

The business is legitimate
The website contains no malware
The website is not a phishing site
The products being sold are genuine
The operator can be trusted

Users must still evaluate the website itself.

SSL Certificates and SEO

HTTPS is important for modern websites and has long been used by Google as a ranking signal.

However, installing SSL should not be treated as a magic SEO technique.

Its broader benefits include:

Secure browsing
User confidence
Modern browser compatibility
Secure authentication
Secure cookies
Access to browser features requiring secure contexts
Better overall website security architecture

When migrating an existing website from HTTP to HTTPS, redirects, canonical URLs, sitemaps, internal links, and related SEO configuration should also be checked.

SSL Certificates for E-Commerce Websites

HTTPS is essential for e-commerce websites because customers may submit sensitive information such as:

Account credentials
Addresses
Contact information
Order information
Payment-related data

However, HTTPS is only one part of e-commerce security.

PCI DSS requirements, secure payment integrations, application security, access controls, patching, logging, and other safeguards may also be required.

SSL Certificates for APIs

APIs should also use HTTPS.

For example:

https://api.example.com/v1/customers

instead of:

http://api.example.com/v1/customers

HTTPS protects information such as:

API keys
Access tokens
Authentication headers
JSON requests
Customer records
Application responses

For higher-security systems, mutual TLS (mTLS) may also be used.

What Is Mutual TLS (mTLS)?

Standard HTTPS normally authenticates the server to the client using the server certificate.

With mutual TLS:

Server authenticates to client + Client authenticates to server

Both parties use certificates.

mTLS is commonly used in:

Enterprise APIs
Zero-trust architectures
Machine-to-machine communication
Financial systems
Internal enterprise services

What Is Certificate Revocation?

Sometimes a certificate needs to be invalidated before its scheduled expiry.

Possible reasons include:

Private key compromise
Certificate issued incorrectly
Domain ownership changes
Security incident
CA policy requirements

Certificate authorities can revoke certificates.

Technologies associated with certificate status include:

CRL — Certificate Revocation List

and

OCSP — Online Certificate Status Protocol

Modern browser behavior around revocation checking varies, and some ecosystems use additional mechanisms to distribute revocation information.

What Is HSTS?

HSTS stands for:

HTTP Strict Transport Security

A website can send an HSTS response header telling compatible browsers to use HTTPS for that site for a specified period.

Example concept:

Strict-Transport-Security: max-age=31536000

Optional directives can extend the policy to subdomains or support preload requirements.

HSTS should be configured carefully because incorrect deployment can make a site inaccessible over HTTP until the policy expires.

How to Check an SSL Certificate in a Browser

The exact interface differs between browsers and versions, but generally you can:

Open the HTTPS website.
Click the site/security controls near the address bar.
Open connection or certificate information.
View certificate details.

Important details to check include:

Issued to / SAN hostnames
Issued by
Valid from
Valid until
Certificate chain
Public-key information

How to Install an SSL Certificate

The exact procedure depends on the hosting platform.

Common platforms include:

Apache
Nginx
Microsoft IIS
cPanel
Plesk
Cloud hosting platforms
Load balancers
Reverse proxies

The general process is:

Generate or securely obtain the private key.
Generate a CSR if required.
Request the certificate.
Complete domain or organization validation.
Obtain the issued certificate.
Install the server certificate.
Install/configure intermediate certificates.
Configure HTTPS.
Redirect HTTP to HTTPS where appropriate.
Test the certificate chain and hostname coverage.
Verify application functionality.
Configure renewal.

SSL Certificate Installation on Microsoft IIS

A typical IIS workflow is:

IIS Manager → Server Certificates → Complete Certificate Request

Then configure the HTTPS binding:

Sites → Website → Bindings → Add/Edit → HTTPS → Select Certificate

The exact process depends on whether the certificate was requested through IIS, imported as a PFX/PKCS#12 package, or deployed using another certificate-management method.

SSL Certificate Installation on Apache

Apache TLS configuration typically references certificate and private-key files.

Conceptually:

SSLCertificateFile

and:

SSLCertificateKeyFile

Modern Apache configurations may use a certificate file containing the appropriate chain, depending on platform and deployment method.

After changing the configuration, validate the Apache configuration before restarting or reloading the service.

SSL Certificate Installation on Nginx

Nginx commonly uses directives such as:

ssl_certificate

and:

ssl_certificate_key

The configured certificate file should contain the appropriate certificate chain required by the deployment.

Always validate the Nginx configuration before reloading the service.

Free vs Paid SSL Certificates

Both free and paid publicly trusted certificates can provide strong TLS encryption when correctly configured.

The main differences are usually related to:

Validation type
Support
Warranty or commercial terms
Management services
Certificate features
Enterprise requirements
Vendor ecosystem

A free DV certificate from a reputable public CA can provide strong cryptographic protection.

A paid certificate is not automatically "more encrypted."

The actual connection security depends heavily on:

TLS version
Cipher configuration
Key strength
Server configuration
Certificate management
Private-key protection

What Is Let's Encrypt?

Let's Encrypt is a widely used nonprofit certificate authority that provides automated domain-validated TLS certificates.

It helped make HTTPS deployment and automated certificate renewal much easier for website administrators.

Automated certificate management is especially useful because short certificate lifetimes make manual renewal less practical.

SSL Certificate Best Practices

Website administrators should follow several important practices:

Use certificates from an appropriate trusted CA.
Prefer TLS 1.3 and securely configured TLS 1.2.
Disable obsolete SSL/TLS protocol versions.
Protect private keys.
Automate certificate renewal where possible.
Monitor certificate expiration.
Configure the full certificate chain.
Redirect HTTP traffic to HTTPS when appropriate.
Remove mixed-content dependencies.
Use secure cookies.
Consider HSTS after confirming HTTPS works correctly everywhere.
Keep web servers updated.
Use modern cryptographic algorithms.
Test certificate deployment after server changes.
Maintain backups and documentation for certificate configuration.

How Long Is an SSL Certificate Valid?

Certificate validity depends on the type of certificate and ecosystem rules.

Publicly trusted TLS certificate lifetimes have become progressively shorter over time, and the industry is moving toward increasingly automated certificate lifecycle management.

Administrators should therefore avoid designing systems that depend on manually renewing certificates only once every several years.

The recommended strategy is:

Automated issuance + Automated deployment + Automated renewal + Expiration monitoring

What Happens If I Do Not Use HTTPS?

An HTTP-only website can face several problems:

Browser "Not Secure" indicators
Unencrypted data transmission
Greater risk on hostile or compromised networks
Inability to safely transmit login credentials
Reduced user confidence
Compatibility limitations with features requiring secure contexts
Security and compliance concerns

HTTPS is now a standard requirement for professional websites.

Can SSL Encrypt Email?

TLS certificates and TLS technology are also used outside websites.

TLS can secure protocols and services such as:

SMTP
IMAP
POP3
LDAP
VPN gateways
APIs
Database connections
Remote services

However, transport encryption is different from end-to-end message encryption.

For example, SMTP over TLS can protect a communication link while an email is being transported, but this does not automatically provide end-to-end encryption of the email content.

Can One SSL Certificate Be Used on Multiple Servers?

Potentially, yes.

Whether a certificate can be deployed across multiple servers depends on:

Certificate licensing/vendor terms
Availability and secure handling of the private key
Hostnames covered by the certificate
Infrastructure design

In load-balanced environments, the same certificate may be installed on multiple TLS termination points, or certificate management may be centralized.

Private-key distribution must be handled securely.

How Does SSL Affect Website Performance?

TLS introduces cryptographic processing and handshake overhead, but modern TLS implementations are highly optimized.

Technologies such as:

TLS 1.3
Session resumption
HTTP/2
HTTP/3
Modern CPUs
Efficient cryptographic libraries

make HTTPS practical even for high-traffic websites.

For most modern deployments, the security benefits far outweigh the performance overhead.

SSL/TLS Security Architecture

A simplified HTTPS architecture can be represented as:

User Browser
↓
DNS Resolution
↓
TCP/QUIC Connection
↓
TLS Handshake
↓
Certificate Validation
↓
Secure Key Establishment
↓
Encrypted Application Traffic
↓
Web Server/Application

The precise transport differs depending on technologies in use—for example, traditional HTTPS commonly runs over TCP, while HTTP/3 uses QUIC.

SSL Certificate Troubleshooting Checklist

If HTTPS is not working correctly, check:

Certificate expiration date
Hostname/SAN coverage
Certificate chain
Intermediate certificates
Private key correspondence
HTTPS binding
Port 443
Firewall configuration
DNS records
Web server configuration
TLS versions
Cipher compatibility
Reverse proxy settings
Load balancer configuration
CDN configuration
Server date/time
HTTP-to-HTTPS redirects
Mixed content
HSTS configuration

For complex environments, also check whether TLS terminates at the web server, reverse proxy, firewall, CDN, or load balancer.

Conclusion

An SSL certificate—more accurately a TLS certificate—is a fundamental component of modern Internet security.

It helps establish an authenticated and encrypted connection between clients and servers.

When properly implemented, HTTPS provides:

Encryption + Authentication + Integrity

However, an SSL certificate should not be confused with complete website security.

A comprehensive security strategy also requires:

Secure coding
Strong authentication
Access control
Software patching
Malware protection
Backups
Monitoring
Firewall protection
Vulnerability management
Secure server configuration

For modern websites, HTTPS should be considered a baseline security requirement rather than an optional feature.

Frequently Asked Questions (FAQ)

1. What is an SSL certificate?

An SSL certificate is a digital certificate used to authenticate a server identity and enable encrypted TLS communication between clients and servers.

2. What does SSL stand for?

SSL stands for Secure Sockets Layer.

3. Is SSL still used?

The SSL protocols themselves are obsolete. Modern systems use TLS, although the term "SSL certificate" remains commonly used.

4. What is TLS?

TLS stands for Transport Layer Security and is the modern successor to SSL.

5. What is HTTPS?

HTTPS is HTTP communication protected using TLS.

6. Why does a website need an SSL certificate?

It enables authenticated, encrypted HTTPS connections and protects information transmitted between users and the website.

7. Does SSL prevent hacking?

No. TLS protects communication in transit but does not prevent all application, server, account, or malware attacks.

8. Does HTTPS mean a website is trustworthy?

No. HTTPS means the connection is encrypted and the certificate is valid for the connection. It does not guarantee that the website operator is trustworthy.

9. What is a Certificate Authority?

A Certificate Authority is an organization that issues and digitally signs certificates.

10. What is a DV SSL certificate?

DV stands for Domain Validation. It verifies control over a domain.

11. What is an OV certificate?

OV stands for Organization Validation and includes validation of organizational information in addition to domain control.

12. What is an EV certificate?

EV stands for Extended Validation and involves more extensive organizational validation.

13. What is a wildcard certificate?

A wildcard certificate protects multiple first-level subdomains, such as *.example.com.

14. What is a SAN certificate?

A SAN certificate contains multiple hostname identities in its Subject Alternative Name extension.

15. What is a CSR?

CSR stands for Certificate Signing Request. It is submitted when requesting a certificate and contains the public key and certificate-request information.

16. What is a private key?

A private key is the confidential cryptographic key associated with the certificate's public key.

17. Should I share my SSL private key?

No. The private key should be protected and should never be publicly shared.

18. What happens when an SSL certificate expires?

Browsers and applications may reject the certificate or display security warnings until a valid certificate is installed.

19. Can I get SSL for free?

Yes. Public certificate authorities such as Let's Encrypt provide free domain-validated TLS certificates.

20. Is paid SSL more secure than free SSL?

Not necessarily. Both can provide strong encryption. Security depends heavily on TLS configuration, algorithms, server security, and key management.

21. What port does HTTPS use?

HTTPS commonly uses TCP port 443. HTTP/3 uses QUIC over UDP, commonly on port 443.

22. What is a self-signed certificate?

It is a certificate signed by its own private key rather than a publicly trusted certificate authority.

23. Why does my browser say "Your connection is not private"?

Possible causes include an expired certificate, hostname mismatch, untrusted CA, missing certificate chain, or incorrect system time.

24. What is an intermediate certificate?

It is a CA certificate positioned between a root CA and an end-entity/server certificate in the chain of trust.

25. What is a root certificate?

A root certificate is the trust anchor at the top of a certificate hierarchy and is typically stored in operating-system or browser trust stores.

26. What is TLS 1.3?

TLS 1.3 is a modern TLS protocol version offering improved security and a simplified, often faster handshake.

27. Should TLS 1.0 and TLS 1.1 be enabled?

For modern public-facing systems, obsolete TLS versions should generally be disabled unless a specific legacy requirement exists and the associated security risk has been assessed.

28. Can SSL secure APIs?

Yes. HTTPS should be used to protect API traffic.

29. What is mTLS?

Mutual TLS authenticates both the client and the server using certificates.

30. What is HSTS?

HTTP Strict Transport Security tells compatible browsers to access a site only through HTTPS for a configured period.

31. What is certificate revocation?

Revocation invalidates a certificate before its normal expiration date.

32. What are OCSP and CRL?

OCSP and CRLs are mechanisms associated with determining whether certificates have been revoked.

33. What is mixed content?

Mixed content occurs when an HTTPS page loads some resources through insecure HTTP.

34. Does SSL improve SEO?

HTTPS is a Google ranking signal, but SSL alone does not guarantee high search rankings.

35. Do informational websites need SSL?

Yes. HTTPS is recommended for essentially all modern public websites.

36. Do login pages need SSL?

Absolutely. Login credentials should never be transmitted over unencrypted HTTP.

37. Can an SSL certificate protect multiple domains?

Yes, if the certificate includes the required domains/hostnames in its SAN entries.

38. Can I transfer an SSL certificate to another server?

Often yes, provided the certificate and corresponding private key can be securely transferred and the deployment complies with applicable vendor terms and infrastructure requirements.

39. How can I verify an SSL certificate?

Use browser certificate information or reputable TLS testing tools to check validity, hostname coverage, certificate chain, and server configuration.

40. Is HTTPS enough to make my website secure?

No. HTTPS is essential, but complete website security also requires secure software, patching, authentication, access controls, monitoring, backups, and vulnerability management.