What it does, plainly
Data travels between a visitor's browser and your server — what they typed into a form, what password they entered, what they browsed. Without SSL that travels as plain text. Anyone on the same Wi-Fi, or anywhere along the path, can read it.
SSL encrypts it. The certificate is two things at once: the key used for encryption, and proof that this key really belongs to your domain.
The second part matters more. Encryption without an identity check is useless — you could be having a beautifully encrypted conversation with a fraudster.
What it does NOT do
This is where almost everyone gets confused.
- It does not make your site secure. If you have a hole in your code or a weak password, SSL doesn't help. A site serving malware has a padlock like everyone else.
- It does not protect data stored on the server. Only data in transit.
- It does not mean the company was vetted. A standard certificate proves exactly one thing: whoever requested it controls the domain. Nothing about the business behind it.
The padlock means "nobody is listening in", not "this person can be trusted".
Why it expires
The most common question, and the answer makes sense once you hear it.
A certificate is a dated credential. If someone steals your key, they can impersonate your site for as long as the certificate is valid. There is a revocation mechanism, but it works badly — browsers frequently don't check at all.
So the industry picked a different fix: don't repair revocation, shorten the window. A stolen key that's valid for 90 days is a far smaller problem than one valid for three years.
Which is exactly why the maximum keeps dropping:
| When | Maximum certificate lifetime |
|---|---|
| Today (since 15 March 2026) | 200 days |
| From 15 March 2027 | 100 days |
| From 15 March 2029 | 47 days |
That's a decision of the CA/Browser Forum, the body where browsers and certificate issuers sit together (DigiCert on the SC-081v3 schedule, checked 2026-07-29).
We use Let's Encrypt, which is already well under that ceiling: the standard certificate is 90 days, with a 6-day option for anyone who wants it (letsencrypt.org/docs/cert-lifetimes, checked 2026-07-29). Their plan is to move the main profile to 64 days in February 2027 and 45 days in February 2028.
What that means for you: manual renewal is dead. At 90 days you could just about keep a calendar reminder. At 45 days it's a lost cause. Renewal has to be automatic — and with us it is.
What it costs you
Nothing. Let's Encrypt is free and included on every plan. It's issued automatically once your domain points at us and the server sees a valid hostname — usually 5–10 minutes after the DNS change goes through.
Renewal is automatic too, around 30 days before expiry. If a renewal fails, that leaves us time to fix it before any visitor sees a warning.
Is a paid certificate ever worth it
Almost never. The difference is in what the issuer checks:
- DV (Domain Validation) — checks only that you control the domain. Let's Encrypt is DV. The encryption is identical.
- OV / EV — the issuer also verifies your company in the commercial register. Costs money, takes days.
EV certificates used to show the company name in green in the address bar. Browsers removed that years ago, having found nobody looked at it. Today the visual difference between a free DV certificate and a EUR 200 EV one is zero.
Pay for OV/EV only if a specific partner, bank or public tender requires it in writing. Otherwise, don't.
"Your connection is not private" — what it actually means
The red screen isn't one problem, it's several:
| Error | Cause |
|---|---|
NET::ERR_CERT_DATE_INVALID | The certificate expired. Or your computer's clock is wrong. Check your device's date before calling — this happens more often than it sounds. |
NET::ERR_CERT_COMMON_NAME_INVALID | The certificate is for a different name. Usually it covers company.com and you opened www.company.com, or vice versa. |
NET::ERR_CERT_AUTHORITY_INVALID | Self-signed certificate, or one from an issuer the browser doesn't trust. |
| Padlock with a warning, but the site loads | "Mixed content" — the page is HTTPS but pulls an image or script over plain HTTP. |
Send us the exact error text and we'll fix it. If your hosting is with us, that's our job, not yours.
One thing that is on you
If your DNS is held at another provider and you change something there, renewal can silently stop working. If you're moving DNS — tell us first.