SSL Certificate
Definition
An SSL certificate is a digital document binding a hostname to a public key, signed by a certificate authority the browser already trusts. Inside it are the names it covers, the issuing authority, a validity window — typically 90 days from Let's Encrypt, up to about a year from commercial issuers — and the signature that makes it checkable. The certificate is the credential; TLS is the protocol that uses it; HTTPS is what you get when an ordinary web request is carried inside that protected connection. A certificate does not encrypt anything by itself; it only proves a name. Most certificates today are domain-validated, meaning the authority confirmed you control the hostname and nothing more about your organisation. A wildcard certificate covers every subdomain at one level, so one of them can serve docs, files and www alike.
Why It Matters
Without a valid certificate the browser does not show a subtle warning — it shows a full-page interstitial telling visitors the site may be impersonating someone, and most of them leave. Expiry is the usual cause, and it is entirely avoidable: a 90-day certificate that nobody renewed takes a working site offline at a precise, predictable minute. Name mismatches do the same thing. A certificate issued for www only will fail for the bare domain, so half your links break while the other half work, which is a confusing failure to diagnose under pressure. Browser features such as geolocation, service workers and the clipboard API also refuse to run without one.
How It Works
You prove control of the hostname, the authority signs, and the server presents the result. Automated issuance through the ACME protocol is now the norm: the server asks for a certificate, the authority sets a challenge, and the server answers it either by publishing a file under /.well-known/acme-challenge/ or by adding a TXT record to DNS. The signed certificate then comes back and is installed alongside the private key, which never leaves the server. During a connection the server sends its certificate plus any intermediate certificates linking it to a root the browser already holds; the browser checks the chain, the dates and the name, then proceeds. Renewal runs on a timer, typically at two thirds of the lifetime, so a 90-day certificate is replaced around day 60.
Real-World Example
A design studio publishes its portfolio on 99helpers at fenn-studio.99helpers.site and it is served over an encrypted connection from the moment the upload finishes, with nothing to buy or install. When the studio later points its own custom domain at the site, a certificate for that name is requested and installed automatically, then renewed on its own thereafter. A job that used to mean a yearly purchase, a certificate signing request and a nervous install is now nothing at all.
Common Mistakes
- ✕Letting a certificate lapse because renewal was manual — a 90-day certificate is not a yearly chore you can diary, it needs automation
- ✕Issuing for www only and assuming the bare domain is covered — a certificate matches the exact names listed in it, and a wildcard covers one level of subdomain, not two
- ✕Installing the leaf certificate without the intermediate chain — desktop browsers often paper over the gap from cached copies while mobile clients reject the connection outright
- ✕Assuming a certificate says something about the organisation behind the site — a domain-validated certificate proves control of a hostname and nothing else
Related Terms
TLS
Transport Layer Security, the protocol that encrypts traffic between a browser and a server and verifies which server it is talking to. SSL was its predecessor and is long dead, but the old name stuck to the paperwork.
HTTPS
HTTP carried inside an encrypted TLS connection, shown in the browser as an https:// address. It is the same web protocol as before, with the traffic protected and the server's identity checked first.
Custom Domain
A custom domain is a name you own, pointed at content somebody else hosts, so visitors see files.acme.com instead of the provider's address. You keep the registration; the provider keeps the servers.
TXT Record
A TXT record holds plain text at a DNS name. For anyone hosting files or a site, the reason you meet one is domain verification — proving to a provider that the name really is yours.
Deployment
A deployment is the act of putting a new version of a site or file where the public can reach it. It is the moment the version you have been working on becomes the version visitors get.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →