An SSL certificate is a small data file on your web server that ties your domain name to an encryption key. When a browser connects, the certificate lets it confirm it has reached your domain and set up an encrypted connection. That is what makes the address start with https. Without a valid one, browsers put a warning in front of your site, which is a poor first impression for somebody trying to book an appointment.
Briefly explained
- A file that lets browsers reach your site securely over HTTPS.
- Every site needs one, not only sites that take payments.
- Certificates expire, so renewal has to be automatic.
- An expired one puts a full-page warning in front of your site.
What does an SSL certificate actually do?
It does two jobs: it encrypts the connection and it confirms the domain.
- Encryption: What a visitor types into your contact form (name, address, phone number) travels scrambled rather than as readable text.
- Identity: The browser checks that the certificate was issued for the address it is visiting, by a certificate authority it trusts.
The name is a leftover. SSL was the original protocol and has been replaced by TLS, but the certificates are still commonly called SSL certificates. If your host talks about TLS certificates, it means the same thing.
Do I really need an SSL certificate?
Yes, on every site, including a simple one with little more than a phone number.
Browsers warn visitors about sites that are not served over HTTPS. A warning screen gives a visitor a reason to go back and choose another result.
Google’s page experience documentation says secure serving does not directly help rankings. It still belongs on any technical SEO checklist, because browsers warn visitors without it. The reason to have HTTPS is the person on the other end and the details they type into your form.
How do you get one?
Usually through your host, and often at no cost.
Free certificates, such as Let’s Encrypt’s, are Domain Validation certificates, which confirm control of the domain, and for a typical service business site that is enough. Some hosts charge an admin fee for setting them up. The price matters less than whether renewal is automatic.
Why do certificates expire?
Because each one is issued for a limited period, and the industry is shortening that period over the next few years.
Every renewal done by hand is a chance to forget. When a certificate lapses, the browser shows a full-page warning instead of your site, and the contact page and booking form are where it hurts most. Automated renewal is the recommended approach, and as lifetimes shrink, renewing by hand stops being realistic.
Check three things with whoever runs your site:
- Automatic renewal is on, and somebody gets an alert if it fails
- Every version of the address is covered, with and without www
- Plain http redirects to https, so old links and printed URLs still land safely
What do the terms mean?
- HTTPS: The secure version of a web address. Most browsers show it with an icon in the address bar.
- TLS: The protocol that replaced SSL. The old name stuck to the certificates.
- Certificate authority: An organization browsers trust to issue certificates.
- Mixed content: A secure page that still loads images or scripts over plain http, which browsers may block or flag.
- Hosting: Where the certificate is usually installed and renewed.
Owner questions
