SSL Certificates

What is an SSL certificate and why do you need one?

An SSL certificate is a digital document, signed by a certificate authority (CA), that binds a domain name to an encryption key; it lets the browser confirm it is talking to the right site and encrypt the connection. The protocol in use today is actually TLS (Transport Layer Security), but the name "SSL" has stuck.

A certificate provides three things:

• Encryption: form data, passwords and payment details cannot be read on the network.
• Integrity: page content cannot be altered by a network in between; ad injection on café or hotel networks is blocked.
• Identity: visitors know the domain really belongs to that site; with OV and EV the company's identity is verified as well.

On sites without a certificate, browsers show a "Not secure" warning in the address bar, and the warning is more prominent on pages with forms. Google uses HTTPS as a ranking signal, and fast protocols such as HTTP/2 and HTTP/3 only work over HTTPS in browsers.

What is the difference between DV, OV and EV SSL?

The difference between DV, OV and EV is not in the strength of encryption but in what the certificate authority verifies; all three use the same TLS encryption. DV verifies only control of the domain, OV verifies that the company exists, and EV verifies the company's legal, physical and operational existence through a strict procedure.

An important current note: browsers no longer show a green bar or the company name in the address bar for EV certificates; organisation details appear in the certificate details. The value of EV lies in the depth of identity verification and in meeting audit or contractual requirements.

When do you need a wildcard SSL certificate?

A wildcard SSL certificate protects all first-level subdomains of a domain with a single certificate; a *.example.com certificate is valid on www, shop, panel, api and every other subdomain. For projects that use many subdomains or add them often, it is far more practical than managing a separate certificate for each.

Limits you should know:

• One level only: *.example.com does not cover second-level subdomains such as test.panel.example.com.
• Root domain: by definition the wildcard covers subdomains; whether the root domain (example.com) is included depends on the certificate's SAN list, so check before ordering.
• No EV: under certificate authority rules, EV certificates cannot be issued as wildcards.
• Key sharing: the same private key is distributed to many servers; if one server is compromised, every subdomain is affected.

Combining different domains (e.g. example.com and example.co.uk) in one certificate is done with a SAN (multi-domain) SSL certificate.

Why are SSL certificates now valid for at most 200 days?

The CA/Browser Forum, the joint rule-making body of browsers and certificate authorities, adopted ballot SC-081 in 2025, gradually shortening the maximum lifetime of publicly trusted TLS certificates; certificates issued on or after 15 March 2026 can be valid for at most 200 days. The next steps of the schedule are also fixed:

The aim is to stop certificates for compromised domains, or domains that have changed hands, from staying valid for a long time. The period for which domain validation can be reused shrinks on the same schedule, so validation is repeated more often too.

The practical consequence: a "one-year SSL" is no longer a single certificate but a series of certificates reissued during the subscription period. If you install certificates by hand, you must renew at least twice a year, which makes automatic renewal and expiry tracking more important than ever.

Free Let's Encrypt or a paid SSL certificate?

Technically, free Let's Encrypt and a paid DV certificate provide the same level of encryption; the differences are validation type, support, coverage and ease of management. Let's Encrypt is a non-profit certificate authority that works fully automatically over the ACME protocol and issues DV certificates only; its certificates are valid for 90 days and renew automatically.

When a paid certificate stands out:

• You need organisational identity: OV and EV are only available as paid certificates.
• Automation is not possible: devices that cannot run an ACME client, older servers or some load balancers.
• Warranty and support: commercial certificates come with a warranty backed by the certificate authority and a support channel.
• Audit requirements: some corporate or industry policies require specific validation levels.

For blogs, brochure sites and the certificates installed automatically on your hosting plan, Let's Encrypt is usually enough; our web hosting plans are a typical example.

How does certificate validation work?

Every certificate requires proof of your control over the domain before it is issued; OV and EV add company validation. For domain control validation (DCV), one of three methods is chosen:

1. Email: the certificate authority sends an approval link to one of the defined administrative addresses such as admin@, webmaster@ or postmaster@.
2. DNS record: you add a TXT or CNAME record with the value given to you. This is the most practical method for wildcard certificates.
3. HTTP file: you upload a specific file to the /.well-known/pki-validation/ path on your site.

For OV validation the company must appear in official records, and its legal name and address must be verified; an up-to-date company registry entry and contact details determine how quickly the process goes. For EV, it is also verified that the organisation is operating and that the applicant is authorised; a telephone confirmation is often made.

To avoid getting stuck during validation, make sure the domain's WHOIS and DNS details are current and that the address receiving the validation email actually works.

How do you install an SSL certificate?

SSL installation has four steps: generate a private key and CSR on the server, order the certificate with the CSR and complete validation, install the issued certificate on the server together with the intermediate chain, and redirect the site to HTTPS.

1. Generate a CSR: the CSR (Certificate Signing Request) is a signing request containing your domain and public key; the private key stays on your server and is never shared.
2. Complete validation: confirm your domain with the DCV method you chose.
3. Install the certificate: in cPanel use the SSL/TLS screen, in Plesk the SSL/TLS Certificates section. In Nginx and Apache, the certificate file and the intermediate chain must be configured together.
4. Redirect: send all HTTP requests to HTTPS with a permanent (301) redirect.

If the intermediate certificate is missing, some browsers and mobile devices show an "untrusted certificate" error, while the problem may go unnoticed on desktop. Check the chain with an SSL test tool after installation.

How do you harden HTTPS after installation?

Installing the certificate is only the first step; a secure configuration means disabling old protocols, enabling HSTS and cleaning up mixed content.

• Protocols: keep only TLS 1.2 and TLS 1.3 enabled; browsers no longer support TLS 1.0 and 1.1.
• HSTS: the Strict-Transport-Security header tells browsers to connect to your site only over HTTPS; do not add includeSubDomains until all your subdomains are ready for HTTPS.
• Mixed content: images, scripts or stylesheets loaded over HTTP on an HTTPS page cause browser warnings or blocking; convert old absolute links starting with HTTP in your database and theme files to HTTPS. In WordPress, updating the site address settings and converting old addresses in content with a search-and-replace tool fixes most issues.
• Certificate chain: make sure the server presents the intermediate certificates as well as your own, and that the server clock is correct.
• Key type: ECDSA keys are smaller and faster than RSA; if you do not need to support very old clients, ECDSA is a good choice.

How does an SSL certificate affect SEO and conversions?

HTTPS is a ranking signal confirmed by Google; on its own its effect is small, but its indirect effects are large. The real difference shows in user behaviour: a visitor who sees a "Not secure" warning may abandon a form, a sign-up or a payment.

The effects of SSL on search and conversions:

• Browser warnings: HTTP pages are marked as not secure in the address bar; this loss of trust shows up immediately in bounce rate.
• Speed: HTTP/2 and HTTP/3 are only available over HTTPS; they speed up parallel loading of multiple resources and contribute to Core Web Vitals metrics.
• Referrer data: when moving from an HTTPS site to an HTTP site, referrer information is restricted, so your analytics may be incomplete.
• Migration risk: wrong redirects, canonical tags or sitemap errors when moving from HTTP to HTTPS can cause a temporary ranking drop.

To migrate without losses, update 301 redirects, canonical URLs and your Search Console property together.

What is a certificate authority, and where do the certificates come from?

A certificate authority (CA) is an organisation whose root certificate is in the trust stores of browsers and operating systems and which is authorised to sign certificates for others; a certificate opens without a warning in the browser because one of these trusted authorities signed it. Authorities are subject to CA/Browser Forum rules and regular independent audits; an authority that breaks the rules can have its root certificate removed from browsers' trusted lists.

LIONFIN sources its paid certificates from internationally recognised certificate authorities through a partnership with TheSSLStore, a long-established certificate distributor; your order, validation and reissues are handled through your customer panel. Free certificates are issued by Let's Encrypt. Whichever route you take, the encryption standard is the same: the certificates are recognised by all modern browsers and are used on TLS 1.2 and TLS 1.3 connections.

Which SSL certificate should you choose?

The right SSL certificate comes down to two questions: how many domains or subdomains will you protect, and what level of identity proof do you want to give your visitors?

On online stores the payment page is usually hosted by the payment provider, so DV is technically enough; OV, however, adds a layer of trust by showing the company name in the certificate. The current coverage and validation times of each product are on the package cards on this page. If your site is on one of our hosting plans, free SSL is already included on most plans; an extra certificate is only needed if you require OV, EV or wildcard.

How do you manage certificate renewals and reissues?

The essence of certificate management is never missing a renewal before expiry and reissuing whenever the key changes. A reissue is the re-issuing of the same certificate with a new CSR within the subscription period; certificates sold by LIONFIN include unlimited reissues.

When you will need a reissue:

• When the certificate's 200-day lifetime runs out before the subscription ends.
• When you change servers or lose the private key.
• When you suspect the private key has been compromised (in that case, have the old certificate revoked).
• When you want to change the key type, for example moving from RSA to ECDSA.

Rather than tracking the calendar by hand, set up alerts on several layers: a certificate expiry check in your own monitoring tool, a calendar reminder and your hosting panel's automatic renewal. As lifetimes shrink, leaving renewal to one person's memory is the most common reason a site greets visitors one morning with a "Your connection is not private" error. If you run your own server, a VPS server with an ACME client such as Certbot can renew Let's Encrypt certificates automatically.