What is an SSL certificate – Definition and Explanation

What is an SSL certificate?

An SSL certificate is a digital certificate that authenticates a website's identity and enables an encrypted connection. SSL stands for Secure Sockets Layer, a security protocol that creates an encrypted link between a web server and a web browser.

Companies and organizations need to add SSL certificates to their websites to secure online transactions and keep customer information private and secure.

In short: SSL keeps internet connections secure and prevents criminals from reading or modifying information transferred between two systems. When you see a padlock icon next to the URL in the address bar, that means SSL protects the website you are visiting.

How do SSL certificates work?

SSL works by ensuring that any data transferred between users and websites, or between two systems, remains impossible to read. It uses encryption algorithms to scramble data in transit, which prevents hackers from reading it as it is sent over the connection. This data includes potentially sensitive information such as names, addresses, credit card numbers, or other financial details.

The process works like this:

• A browser or server attempts to connect to a website (i.e., a web server) secured with SSL.

• The browser or server requests that the web server identifies itself.

• The web server sends the browser or server a copy of its SSL certificate in response.

• The browser or server checks to see whether it trusts the SSL certificate. If it does, it signals this to the webserver.

• The web server then returns a digitally signed acknowledgment to start an SSL encrypted session.

• Encrypted data is shared between the browser or server and the webserver

This process is sometimes referred to as an "SSL handshake." While it sounds like a lengthy process, it takes place in milliseconds.

When a website is secured by an SSL certificate, the acronym HTTPS (which stands for Hyper Text Transfer Protocol Secure) appears in the URL. Without an SSL certificate, only the letters HTTP – i.e., without the S for Secure – will appear. A padlock icon will also display in the URL address bar. This signals trust and provides reassurance to those visiting the website.

Why you need an SSL certificate

Websites need SSL certificates to keep user data secure, verify ownership of the website, prevent attackers from creating a fake version of the site, and convey trust to users.

If a website is asking users to sign in, enter personal details such as their credit card numbers, or view confidential information such as health benefits or financial information, then it is essential to keep the data confidential. SSL certificates help keep online interactions private and assure users that the website is authentic and safe to share private information with.

More relevant to businesses is the fact that an SSL certificate is required for an HTTPS web address. HTTPS is the secure form of HTTP, which means that HTTPS websites have their traffic encrypted by SSL. Most browsers tag HTTP sites – those without SSL certificates – as "not secure." This sends a clear signal to users that the site may not be trustworthy – incentivizing businesses who have not done so to migrate to HTTPS.

How to obtain an SSL certificate

SSL certificates can be obtained directly from a Certificate Authority (CA). Certificate Authorities – sometimes also referred to as Certification Authorities – issue millions of SSL certificates each year. They play a critical role in how the internet operates and how transparent, trusted interactions can occur online.

The cost of an SSL certificate can range from free to hundreds of dollars, depending on the level of security you require. Once you decide on the type of certificate you require, you can then look for Certificate Issuers, which offer SSLs at the level you require.

Obtaining your SSL involves the following steps:

• Prepare by getting your server set up and ensuring your WHOIS record is updated and matches what you are submitting to the Certificate Authority (it needs to show the correct company name and address, etc.)

•  Generating a Certificate Signing Request (CSR) on your server. This is an action your hosting company can assist with.

•  Submitting this to the Certificate Authority to validate your domain and company details

Once obtained, you need to configure the certificate on your web host or on your own servers if you host the website yourself.

How quickly you receive your certificate depends on what type of certificate you get and which certificate provider you procure it from. Each level of validation takes a different length of time to complete. A simple Domain Validation SSL certificate can be issued within minutes of being ordered, whereas Extended Validation can take as long as a full week.

Can an SSL certificate be used on multiple servers?

It is possible to use one SSL certificate for multiple domains on the same server. Depending on the vendor, you can also use one SSL certificate on multiple servers. This is because of Multi-Domain SSL certificates, which we discussed above.

As the name implies, Multi-Domain SSL Certificates work with multiple domains. The number is left up to the specific issuing Certificate Authority. A Multi-Domain SSL Certificate is different from a Single Domain SSL Certificate, which – again, as the name implies – is designed to secure a single domain.

To make matters confusing, you may hear Multi-Domain SSL Certificates, also referred to as SAN certificates. SAN stands for Subject Alternative Name. Every multi-domain certificate has additional fields (i.e., SANs), which you can use to list additional domains that you want to cover under one certificate.

Unified Communications Certificates (UCCs) and Wildcard SSL Certificates also allow for multi-domains and, in the latter case, an unlimited number of subdomains.

What happens when an SSL certificate expires?

SSL certificates do expire; they don't last forever. The Certificate Authority/Browser Forum, which serves as the de facto regulatory body for the SSL industry, states that SSL certificates should have a lifespan of no more than 27 months. This essentially means two years plus you can carry over up to three months if you renew with time remaining on your previous SSL certificate.

SSL certificates expire because, as with any form of authentication, information needs to be periodically re-validated to check it is still accurate. Things change on the internet, as companies and also websites are bought and sold. As they change hands, the information relevant to SSL certificates also changes. The purpose of the expiry period is to ensure that the information used to authenticate servers and organizations is as up-to-date and accurate as possible.

Previously, SSL certificates could be issued for as long as five years, which was subsequently reduced to three and most recently to two years plus a potential extra three months. In 2020, Google, Apple, and Mozilla announced they would enforce one-year SSL certificates, despite this proposal being voted down by the Certificate Authority Browser Forum. This took effect from September 2020. It is possible that in the future, the length of validity will reduce still further.

When an SSL certificate expires, it makes the site in question unreachable. When a user's browser arrives at a website, it checks the SSL certificate's validity within milliseconds (as part of the SSL handshake). If the SSL certificate has expired, visitors will receive a message to the effect of — "This site is not secure. Potential risk ahead".

While users do have the option to proceed, it is not advisable to do so, given the cybersecurity risks involved, including the possibility of malware. This will significantly impact bounce rates for website owners, as users rapidly click off the homepage and go elsewhere.

Keeping on top of when SSL certificates expire presents a challenge for larger businesses. While smaller and medium-sized businesses (SMEs) may have one or only a few certificates to manage, enterprise-level organizations that potentially transact across markets – with numerous websites and networks – will have many more. At this level, allowing an SSL certificate to expire is usually the result of oversight rather than incompetence. The best way for larger businesses to stay on top of when their SSL certificates expire is by using a certificate management platform. There are various products on the market, which you can find using an online search. These allow enterprises to see and manage digital certificates across their entire infrastructure. If you do use one of these platforms, it is important to log in regularly so you can be aware of when renewals are due.

If you allow a certificate to expire, the certificate becomes invalid, and you will no longer be able to run secure transactions on your website. The Certification Authority (CA) will prompt you to renew your SSL certificate before the expiration date.

Whichever Certificate Authority or SSL service you use to obtain your SSL certificates from will send you expiration notifications at set intervals, usually starting at 90 days out. Try to ensure that these reminders are being sent to an email distribution list — rather than a single individual, who may have left the company or moved to another role by the time the reminder is sent. Think about which stakeholders in your company are on this distribution list to ensure the right people see the reminders at the right time.

• WHAT IS AN SSL CERTIFICATE – DEFINITION AND EXPLANATION
• adam@onlinewebdesign.co.uk