Security
SSL/TLS certificates explained for website owners
People still say “SSL certificate,” but modern HTTPS uses TLS. The certificate is one part of the encrypted connection between a browser and the server; it proves identity for the requested hostname and helps establish the secure session.
The certificate has to match the hostname
A certificate for one hostname does not automatically cover every subdomain or alternate name. The browser checks whether the requested hostname is included in the certificate and whether the issuing chain is trusted.
HTTPS needs more than certificate issuance
After a certificate is installed, verify that HTTP redirects to HTTPS, internal links use the intended canonical HTTPS URL, application configuration knows its public scheme, and embedded resources do not create mixed-content warnings.
Renewal must be automated and monitored
Short-lived certificates are normal. The operational requirement is not “install once”; it is reliable renewal plus enough monitoring to notice when renewal fails before visitors see an expiry warning.
HSTS is useful after HTTPS is stable
HTTP Strict Transport Security tells supporting browsers to use HTTPS for a host for a period of time. Because browsers remember that instruction, enable it only after HTTPS, redirects, subdomain decisions, and certificate renewal are working correctly.
A certificate does not make the application secure
TLS protects data in transit between endpoints. It does not fix vulnerable plugins, weak passwords, broken access controls, exposed databases, malicious code, or an unpatched operating system. Treat HTTPS as a required transport layer, not a complete security program.