An SSL certificate is a digital certificate that verifies a website’s identity and enables an encrypted HTTPS connection between a browser and server. Despite its common name, modern certificates use TLS, the security protocol that replaced SSL. It protects data in transit, but it does not prove that a website’s content or operator is trustworthy.
SSL certificate
What Is an SSL Certificate?
An SSL certificate is a digital certificate that verifies a website’s identity and enables an encrypted HTTPS connection between a browser and server. “SSL certificate” remains the common name, but modern connections use TLS. HTTPS means Hypertext Transfer Protocol Secure, or HTTP protected by TLS.
How SSL Certificates Work
How does an SSL certificate work? It supports a brief security check, called a TLS handshake, before information is exchanged.
- A browser connects to a website using HTTPS.
- The server sends its certificate and public key.
- The browser checks the certificate’s issuer, validity period, and matching domain name.
- The browser and server create shared session keys.
- Login details, form entries, and API requests travel in encrypted form.
SSL vs. TLS vs. HTTPS
SSL is obsolete because it has known security weaknesses. TLS replaced it, while the older label persists in everyday use.
| Term | Meaning |
|---|---|
| SSL | Legacy encryption protocol, no longer appropriate for modern connections. |
| TLS | The current protocol that encrypts and authenticates connections. |
| HTTPS | HTTP traffic carried over a TLS-protected connection. |
Certificate Types and Validation Levels
Choose validation for the identity assurance needed, and coverage for the domains an application serves.
| Type | Best fit |
|---|---|
| Domain validated | Confirms control of a domain, suitable for most sites and apps. |
| Organization validated | Adds checks on an organization’s identity. |
| Extended validation | Uses more extensive identity review, where policy requires it. |
| Single, wildcard, or multi-domain | Protects one hostname, subdomains, or several named domains. |
Benefits of SSL Certificates
HTTPS is a baseline requirement for public web applications.
- Encrypts data while it travels across networks.
- Authenticates the server’s domain to the browser.
- Helps detect in-transit tampering.
- Protects logins, forms, and API traffic from casual interception.
- Allows modern browsers to load the site without security warnings.
Practical Limits of SSL Certificates
A certificate protects a connection, not every part of an application.
- It cannot make a phishing site trustworthy merely because it uses HTTPS.
- It cannot fix insecure code, weak passwords, malware, or server breaches.
- A certificate can be misused if its private key is stolen, which is why key protection and revocation matter.
- It does not protect data after the server receives it.
SSL Certificate Lifecycle and Common Failures
A certificate is issued after domain-control validation, installed with its certificate chain, renewed before expiry, and revoked if its key is compromised. Browser warnings commonly result from an expired certificate, a hostname mismatch, a missing intermediate certificate, or mixed content where an HTTPS page loads an insecure resource. Visitors can inspect a site’s certificate through the browser’s site-information or padlock menu.
Using HTTPS for Apps Built with Emergent
When deploying a full-stack app, test HTTPS on custom domains, authentication forms, browser API calls, and production redirects. An AI web app builder can speed up application creation, while sound app design and development practices still require checking certificate renewal and secure production behavior. Build secure web apps with Emergent.
Start Building
on Emergent today
on Emergent today
Start Building
