What it actually is
A certificate is a small file that lives on the web server. It says "this is the site for example.com", it carries a public key, and it is signed by an outside organisation called a certificate authority.
When you open a page, your browser reads that file, checks the signature, checks the name matches the address you typed, and checks it has not expired. If everything lines up, the browser and the server set up an encrypted connection using TLS and you see HTTPS in the address bar.
If anything does not line up, the browser stops and warns the visitor. It does not ask politely.
They expire, and that is the usual problem
Certificates are issued for a fixed period. When one runs out, the site does not degrade quietly. Every visitor hits a full-page browser warning telling them the site is not secure, and most of them leave immediately.
This is why automation matters more than any other detail on this page. A certificate that renews itself will never embarrass you. A certificate that someone has to remember to renew will eventually be forgotten, usually on a weekend.
The good news is that most hosts and platforms now handle this for you. Shopify, Wix, Squarespace, BigCommerce and Webflow all provision a free certificate automatically and renew it automatically. On cPanel hosting the same job is done by AutoSSL, which renews certificates due to expire within 29 days.
Validation levels, and why the padlock proves less than you think
Not all certificates check the same things before they are issued.
- →Domain validated (DV) is the common free kind. The authority checks one thing: that you control the domain. It does not check who you are, whether your business exists, or whether you are honest.
- →Organisation validated (OV) involves some checking of the organisation behind the domain.
- →Extended validation (EV) involves the most vetting. Browsers used to show a green company name for these. They mostly stopped, because shoppers did not understand or notice it.
The honest version
This is the part most articles skip, so here it is plainly.
A certificate and a padlock mean the connection is encrypted. They do not mean the business is honest. Scammers get valid certificates for free, in minutes, for the fake shop they set up yesterday. A padlock on a scam site is still a real padlock.
So the signal only runs one way. A missing certificate is a serious red flag and a good reason to close the tab. A present certificate proves very little on its own. It is the floor, not the ceiling. We wrote more about this in does HTTPS mean a website is safe.
If you run the site
A few things worth knowing.
- →The order is always the same: get the certificate working first, then force HTTPS, then consider HSTS. Never do it backwards.
- →Some platforms take up to 48 hours to issue a certificate after you connect a domain. That wait is normal, not a fault.
- →Custom third-party certificates are not allowed on Shopify, Wix or Squarespace. They are supported on BigCommerce and on Webflow Enterprise, though Webflow does not auto-renew custom certificates, which puts the reminder back on you.
- →After HTTPS is on, watch for mixed content. A single image still loading over HTTP can break the padlock on an otherwise fine page.
How to check yours
Open your own site in a private window and look at the address bar. If there is no warning and the padlock is there, the certificate is valid right now.
That tells you about today. It does not tell you what happens on renewal day. If you want the expiry date and the rest of your setup checked for you, run a free check and we will look.
We have step by step instructions for every major platform, including the ones that will not let you.
See how to set up SSL on your platform