SSL certificate
An SSL certificate is a file on your web server that lets browsers open an encrypted https connection and check that they reached your domain. The protocol is now called TLS, and the name SSL stayed. It proves control of a domain, not who runs the site.
- By
- WP Ministry
- Published
In short
- A certificate is what makes https work. The connection is encrypted, and the browser can confirm it reached your domain.
- A free certificate from Let's Encrypt lasts 90 days by default and is meant to be renewed by software. The default is due to fall to 64 days in February 2027 and to 45 days in February 2028.
- A certificate proves control of a domain name. It says nothing about who runs the site or whether the site is safe.
An SSL certificate is a small file on your web server that makes https addresses work. It ties a cryptographic key to your domain name and is issued by a certificate authority. With it, a browser can confirm it has reached your domain, and what passes between the two is encrypted, so nobody on the way can read it or change it.
The name is a leftover. SSL, the Secure Sockets Layer, is the predecessor of TLS, Transport Layer Security. The internet's standards body ruled in June 2015 that SSL 3.0 must not be used. Every "SSL certificate" issued today is used with TLS. It is the same file under an older name.
Where you meet it
- In the address. A site with a working certificate answers at
https://. WordPress's documentation notes that browsers put the words "not secure" beside the address of a site without one. - In your hosting control panel, where a certificate is issued and renewed. How to install a free SSL certificate on WordPress has the steps.
- In
wp-config.php. The old name lives on in WordPress's own settings:define( 'FORCE_SSL_ADMIN', true );forces logins and the admin onto https.
What it proves, and what it does not
A free certificate from Let's Encrypt is a Domain Validation certificate. The issuer checks one thing: that whoever asked for it controls the domain. So the certificate tells a visitor they have reached the server for that name.
It does not tell them who runs the site. Let's Encrypt's own words are that such a certificate says nothing about "a site's content or who runs it". A site can hold a valid certificate and still be a scam or carry malware. For the other kinds, Organization Validation and Extended Validation, the issuer also verifies the legal entity behind the site. Let's Encrypt does not offer them.
How long one lasts
Let's Encrypt's certificates are free and last 90 days by default. It recommends renewing a 90-day certificate every 60 days, by software and not by hand. It has announced that the default falls to 64 days on February 10, 2027, and to 45 days on February 16, 2028, ahead of an industry limit of 47 days that starts on March 15, 2029. All three dates are still to come.
What goes wrong
- It expires, or covers the wrong name. A renewal failed, or the certificate covers
example.comand notwww.example.com. Either ends in the browser warning that how to fix "Your connection is not private" deals with. - Pages still ask for http. After the switch, a page loaded over https that fetches an image or a script over plain http is called mixed content. See how to fix mixed content warnings.
- A redirect loop. WordPress's documentation warns that forcing https behind a proxy that handles the certificate sends requests into an endless redirect loop until WordPress is told about the proxy. See how to fix ERR_TOO_MANY_REDIRECTS.
How to look at yours
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -issuer -datesIt prints who issued the certificate and the two dates it is valid between:
issuer=C=US, O=SSL Corporation, CN=Cloudflare TLS Issuing ECC CA 3
notBefore=Sep 26 22:49:11 2026 GMT
notAfter=Dec 25 22:56:35 2026 GMTCommon questions
Is a free SSL certificate good enough?
For most sites, yes. Let's Encrypt says its certificates are standard Domain Validation certificates, trusted by most browsers and operating systems. If a contract asks for Organization Validation or Extended Validation, you need an issuer that offers those.
Does an SSL certificate mean a site is safe?
No. It means the connection is private and the server controls the domain name. It says nothing about who owns the site or what the site does.