What Is an SSL Certificate, and Do You Need to Pay for One?
The padlock in the address bar has quietly become the thing people check before typing a card number. Fair enough.
What most site owners actually want to know is narrower than “how does encryption work”. They want to know whether the free certificate their host switched on is doing the same job as the one a reseller is trying to sell them. Mostly it is. There are a few situations where paying is reasonable, and it is worth knowing early whether you are in one of them.
Short answer: An SSL certificate is a small file on your server that proves your domain is yours and lets browsers encrypt everything sent to it. Without one, browsers label the site as not secure. Free certificates encrypt exactly as strongly as paid ones. What you pay for is vetted business details, a warranty and longer validity, not better encryption.
What does an SSL certificate actually do?
Two jobs. It encrypts the connection between a visitor and your server so nobody sharing the same cafe wifi can read what is being sent, and it proves that the server answering for your domain is genuinely entitled to. The padlock is the browser telling you both checks passed.
The second job is the one people forget. Encryption on its own is easy; anyone can encrypt traffic to a server they control. The certificate is what stops a machine in the middle pretending to be your bank, which is why certificates come from a small number of authorities browsers already trust rather than from whoever runs the site.
Note what is not in that list. A certificate says nothing about whether the business behind the site is honest, and nothing about whether the site has been broken into.
What is the difference between a free and a paid certificate?
The encryption is identical. Both use the same algorithms and the same key lengths, and a browser treats them the same way. The differences are administrative: how much checking the certificate authority does before issuing, how long the certificate lasts, and whether there is a financial warranty attached.
| Type | What is checked | How it is issued | Who it suits |
|---|---|---|---|
| Domain validated (DV) | That you control the domain, nothing more | Automated, usually finished in minutes | Almost every small business site, blog and brochure site |
| Organisation validated (OV) | Domain control plus the legal existence of the business | A person reviews documents, so it takes longer | Sites where a compliance policy names it |
| Extended validation (EV) | A deeper check of the registered entity | Longest process, most paperwork | Banks, and organisations with an internal rule requiring it |
| Wildcard | Domain control, applied to every subdomain at one level | Automated or manual depending on the authority | Sites running many subdomains at once |
EV certificates used to trigger a green bar with the company name in it. Browsers removed that treatment because visitors did not read it, which quietly removed the main marketing argument for EV. The cases where paying still stacks up are covered in the guide on whether an SSL certificate is worth buying in Australia.
How does a certificate get issued and renewed?
The server generates a private key and a signing request, sends the request to a certificate authority, and proves it controls the domain, normally by publishing a file or a DNS record the authority checks for. The authority signs and returns the certificate. On managed hosting all of that happens without you seeing it.
Free certificates have short lifetimes by design, so renewal is automatic or it does not happen. That is a feature. A short automated cycle that has run cleanly for years beats a long-lived certificate that depends on somebody noticing a reminder email in a mailbox they no longer use.
GoodHost cPanel plans include a free SSL certificate that renews automatically, alongside daily malware scanning and Imunify360. The hosting security page lists what is switched on by default.
What happens when a certificate expires?
Browsers stop trusting it immediately and show a full page interstitial warning instead of your site. There is no grace period and no soft failure. Visitors have to click through a screen that tells them your site may be impersonating itself, and most of them will not.
Expiry is one of the more common causes of a site that appears to be down when the server is perfectly healthy. If you are chasing that sort of problem, the certificate is worth ruling out early, and the walkthrough on diagnosing a site that will not load covers where it sits in the order of checks.
Is HTTPS on its own enough?
No. HTTPS protects data moving between the visitor and the server, which is a genuine and necessary thing. It does not patch your plugins, choose better passwords, restrict admin logins or stop a compromised theme from injecting spam links into your pages. Those are separate controls with separate failure modes.
- Keep the platform, plugins and themes current, because outdated code is the most common way in.
- Use unique passwords on hosting, database and site admin accounts, and turn on two factor authentication where it exists.
- Keep working backups you have actually restored once, not just backups that exist.
- Redirect HTTP to HTTPS at the server so the encrypted version is the only one anyone reaches.
The full run through lives in the security checklist for Australian businesses, and the rest of the security and backups guides cover the pieces around it.
Is it called SSL or TLS?
Technically TLS. SSL was the original protocol and every version of it has been retired as broken. Your browser negotiates TLS. The name SSL stuck to the certificates, the product pages and the control panel menus, so both words end up meaning the same thing in ordinary use.
Nobody will misunderstand you for saying SSL. The distinction starts to matter when someone asks which protocol versions your server accepts, which is unpacked in the piece on what separates SSL from TLS.
Frequently asked questions
Does an SSL certificate slow my website down?
Not in any way a visitor will notice on a modern server. There is a small handshake at the start of a connection, but HTTPS also gives you access to newer, faster protocols that plain HTTP cannot use, so most sites end up level or slightly ahead. If your site feels slow after switching, the cause is almost always mixed content or a redirect loop, not the encryption itself.
Why does my site still say “not secure” when the certificate is installed?
Usually mixed content. The page itself loads over HTTPS, but an image, stylesheet or script on it is still requested over plain HTTP, so the browser downgrades the padlock. Search your theme and content for hard-coded http:// links and fix them. The other common cause is that the certificate covers example.com but not www.example.com, or the reverse.
Do I need a separate certificate for a subdomain?
It depends on the certificate. A standard certificate covers the exact names listed on it, so shop.example.com needs its own unless it was included when the certificate was issued. A wildcard certificate covers every subdomain at one level, which is tidier if you run several. Most hosting control panels will just issue a new free certificate per subdomain automatically.
Can I move my SSL certificate to a new host?
You can, if you hold the private key and the certificate file, and paid certificates are usually portable this way. In practice most people do not bother. The new host will issue a fresh free certificate once the domain points at it, which takes minutes and avoids handling key files by email. Plan the order so the certificate exists before you switch DNS.
Does an SSL certificate protect my site from being hacked?
No, and this trips people up constantly. A certificate protects data in transit between browser and server. It does nothing about an outdated plugin, a weak admin password or a vulnerable contact form. A site can hold a perfectly valid certificate and still be serving malware. Encryption and site security are separate jobs.
If you are not certain your certificate is installed cleanly, open your site in a private window and click the padlock: it will tell you who issued the certificate and when it expires. If the details look wrong, or the renewal has stopped running, the GoodHost security page sets out what runs on a cPanel account by default and who to ask when something needs a look.