What is SSL/TLS?
SSL and TLS are cryptographic protocols that encrypt data sent between a browser and a web server. They are what make HTTPS work — the padlock in your browser's address bar.
SSL vs TLS
SSL (Secure Sockets Layer) was the original protocol. TLS (Transport Layer Security) is its modern, more secure successor. All versions of SSL are now deprecated. When someone says "SSL certificate" they almost always mean a TLS certificate. Modern sites should use TLS 1.2 or TLS 1.3.
What an SSL/TLS Certificate Does
A certificate binds a domain name to a cryptographic public key and is issued by a trusted Certificate Authority (CA). When your browser connects to a site, it verifies:
- The certificate was issued by a trusted CA
- The domain on the certificate matches the site you're visiting
- The certificate hasn't expired
Certificate Types
- DV (Domain Validated) — proves control of the domain. Fastest to obtain (minutes via Let's Encrypt).
- OV (Organisation Validated) — includes verified organisation information.
- EV (Extended Validation) — highest level; shows organisation name in some browsers.
- Wildcard — covers a domain and all its subdomains (
*.example.com).
What HTTPS Protects Against
- Eavesdropping — data is encrypted in transit
- Tampering — any modification is detectable
- Impersonation — certificate verifies you're talking to the real server
Check an SSL certificate — expiry date, issuer, and chain: Open SSL Certificate Checker →
Frequently Asked Questions
Does HTTPS mean a site is safe?
HTTPS means the connection is encrypted. It does not mean the site itself is trustworthy or legitimate — phishing sites can and do use HTTPS. Look at the domain, not just the padlock.
How do I get a free SSL certificate?
Let's Encrypt provides free, automated DV certificates. Most web hosts and CDNs (Cloudflare, Netlify, Vercel) provision them automatically.
Related Terms
- DNS — Resolves domain names before the TLS handshake begins.
- HTTP Headers — Include security headers like HSTS to enforce HTTPS.