SSL Certificate Guide

What does the padlock really mean? Learn how HTTPS and certificates work, how to inspect any site's certificate yourself, and test your knowledge with a short quiz.

Ethical Use Only: These tools are for defensive purposes — securing your own accounts and systems. Never use security knowledge against systems you do not own or lack written permission to test.

HTTPS in 30 seconds

When you see https:// and a padlock, your browser has done three things:

Encrypted the connection — nobody on the network (café WiFi, your ISP) can read what you send.
Authenticated the site — the site proved it owns that domain name using a digital certificate issued by a trusted Certificate Authority (CA).
Protected integrity — the data cannot be secretly modified in transit.

What the padlock does NOT mean: that the site is honest. Scammers can get free certificates too. A padlock on paypa1-login.tk still means a scam — just an encrypted one. Always check who the site claims to be, not just the padlock.

How to inspect a certificate (try it on any site)

Chrome / Edge: click the padlock (or "Not secure") left of the address bar → Connection is secure → Certificate is valid.
Firefox: click the padlock → Connection secure → More information → View Certificate.
Safari: click the padlock → Show Certificate.

Certificate fields, explained

Field	What it tells you
Subject / Common Name	Who the certificate was issued to — should match the site's domain.
Issuer (CA)	Which Certificate Authority vouches for the site (e.g. Let's Encrypt, DigiCert).
Valid from / to	The dates the certificate is valid. Expired = browser warning.
Subject Alternative Names	All domain names this certificate covers.
Signature algorithm	The cryptography used (e.g. SHA-256 with RSA) — proves it wasn't forged.

Before entering sensitive info, verify

The address bar shows https:// and a padlock with no warnings.
The domain name is exactly right — no lookalikes (see our phishing URL analyzer).
You navigated there yourself (typed it or used a bookmark), not via a link in a message.
There are no browser warnings like "Your connection is not private".

Test yourself — 5 questions

About This Tool

What this tool does

The SSL Certificate Guide explains what the padlock in your browser really means and, for site owners, how to get and maintain a certificate for your own website. SSL/TLS certificates enable HTTPS: they encrypt traffic between the browser and the server and prove the site is who it claims to be.

For visitors, the guide explains how to interpret certificate warnings, what "not secure" means, and why you should never enter sensitive information on a page without HTTPS. For site owners, it covers obtaining a free certificate, installing it, setting up automatic renewal, and redirecting all traffic to HTTPS.

It is for everyday web users and for bloggers, freelancers, and small businesses running their own sites. Certificates are a defensive technology: they protect your visitors' data in transit and are now a baseline expectation for any legitimate website.

How to use it

As a visitor: learn what the padlock icon and certificate details show, and treat browser certificate warnings as stop signs, not annoyances to click through.
As a site owner: obtain a certificate from a trusted certificate authority — free automated options exist and are widely used.
Install the certificate on your hosting following your provider's guide, then enable automatic renewal so it never expires unexpectedly.
Redirect all HTTP traffic to HTTPS and check that every page, image, and script loads securely (no "mixed content").
Test your setup with an independent SSL checker and fix any issues it reports.
Set a calendar reminder to verify renewal is working, even with automation in place.

Defensive security tips

Never bypass certificate warnings casually. A warning can mean an expired certificate — or an attacker intercepting your connection. On important sites, stop and investigate.
HTTPS is necessary but not sufficient. A phishing site can have a valid certificate. Encryption plus the correct domain is what makes a site trustworthy.
Automate renewal. Expired certificates take sites offline and erode trust. Automated renewal with monitoring is the reliable approach.
Secure the whole page. One insecure image or script on an HTTPS page ("mixed content") weakens the protection. Serve everything over HTTPS.
Keep private keys private. A certificate's private key must never be shared, emailed, or stored in public repositories. If it leaks, replace the certificate.

FAQs

What is the difference between SSL and TLS?

SSL is the older name; TLS is the modern protocol that actually secures connections today. People still say "SSL certificate" out of habit, but what you get and use is a TLS certificate.

Are free certificates trustworthy?

Yes. Free automated certificate authorities are trusted by all major browsers and provide the same encryption as paid ones. Paid certificates mainly add organizational validation or warranties, which most small sites do not need.

Does HTTPS make my site rank better?

Search engines treat HTTPS as a positive signal, but the main reasons to use it are security and user trust: browsers now label non-HTTPS pages "not secure," which drives visitors away.

My browser says a site's certificate is invalid. What should I do?

Do not enter any information or log in. If it is a site you trust, contact the site owner about the expired or misconfigured certificate, and check that your device's date and time are correct — a wrong clock can cause false warnings.