What Is an SSL Certificate? How It Works and Which One You Need
An SSL certificate encrypts the connection between your site and its visitors. Here is how it works, how it differs from TLS, which type you need and how to test it.
An SSL certificate is a digital file that encrypts the connection between your website and a visitor's browser and confirms that the site really belongs to your domain. A site with a certificate opens over https:// and shows a secure connection icon. Without one, or if it has expired or been set up wrongly, browsers show "Your connection is not private" and most visitors turn back. This guide explains how SSL works, how it differs from TLS, which certificate type you actually need, how to test yours and what changed in 2026.
What does an SSL certificate do?
A certificate does three jobs:
- Encryption: names, phone numbers, emails and payment details sent through your forms cannot be read in transit, even on a shared hotel Wi-Fi.
- Authentication: visitors know they reached your real site.
- Integrity: nobody can alter the page on the way, for example by injecting ads or malicious code.
There is a legal side too. Any site with a contact form collects personal data, and Turkish data protection law (KVKK) expects appropriate security measures. Running a form over an unencrypted connection does not meet that standard. We cover the rest in our KVKK compliance guide.
What is the difference between SSL and TLS?
SSL was the original encryption protocol, developed in the 1990s. Security flaws were found over time and TLS replaced it. The last version, SSL 3.0, was formally deprecated by the IETF in 2015. Browsers and servers today use TLS 1.2 and TLS 1.3.
So why do we still say "SSL certificate"? The name stuck. A certificate is an identity document that works independently of the protocol, and every "SSL certificate" on sale is used over TLS. You never have to choose between the two. What you should check is that your server has old SSL and TLS 1.0/1.1 switched off and TLS 1.2 and 1.3 switched on.
How does SSL work?
When someone opens your site, the browser and server run a quick handshake before the page loads:
- The browser connects and the server sends its certificate.
- The browser checks it: was it issued by an authority it trusts, is it still valid, does it cover the address being visited?
- If it passes, both sides agree on an encryption key used only for that session.
- Everything sent after that is encrypted with the key.
This takes milliseconds and the visitor never notices. If any check in step 2 fails, the browser stops and shows a security warning.
Certificate types
| Type | Validates | Suits | Cost |
|---|---|---|---|
| DV (domain validated) | You control the domain | Business sites, blogs, most online stores | Free (Let's Encrypt) or low cost |
| OV (organisation validated) | The company legally exists | Corporate portals, B2B platforms | Annual fee |
| EV (extended validation) | Detailed company records | Banks and large financial firms | Most expensive |
| Wildcard | All subdomains of one domain | Sites with many subdomains | Available as DV or OV |
The encryption is the same across types; what differs is how thoroughly the authority checks who you are. Browsers stopped showing the company name for EV certificates years ago, so visitors see no difference between a free DV certificate and an expensive EV one.
Which certificate do you need?
| Type of site | Recommended | Note |
|---|---|---|
| Business website, blog | Free DV | Enough to protect your contact form |
| Hotel, tour or booking site | Free DV | Cover the payment subdomain too if it is separate |
| Online store | DV, or OV if you want your company identity verified | Even if cards are taken on the payment provider's page, the whole site should be HTTPS |
| Many subdomains | Wildcard (DV or OV) | One certificate covers every subdomain |
| Bank or large financial firm | OV or EV | Usually required by internal policy or audits |
For most business, hotel and tour websites in Antalya, a free DV certificate is enough. Before paying for one, ask what it would actually give you.
What changed in 2026: shorter lifetimes
In April 2025 the CA/Browser Forum, the body of browser makers and certificate authorities, adopted Ballot SC-081, which shortens certificate lifetimes in stages:
- Certificates issued from 15 March 2026: maximum 200 days.
- From 15 March 2027: 100 days.
- From 15 March 2029: 47 days.
Renewing by hand once a year is no longer an option. Automatic renewal (ACME) must be switched on in your hosting panel and someone needs to check it keeps working. Google has also announced plans to make HTTPS the default connection in Chrome, so visitors will see warnings more often on unencrypted sites.
"Your connection is not private": causes and fixes
| Error | Cause | Fix |
|---|---|---|
| NET::ERR_CERT_DATE_INVALID | Certificate expired, or the visitor's clock is wrong | Renew and enable auto-renewal |
| NET::ERR_CERT_COMMON_NAME_INVALID | Certificate does not cover www or a subdomain | Reissue it to cover every hostname |
| NET::ERR_CERT_AUTHORITY_INVALID | Self-signed certificate or missing intermediate chain | Use a trusted authority, install the full chain |
| ERR_SSL_VERSION_OR_CIPHER_MISMATCH | Outdated TLS settings on the server | Enable TLS 1.2 and 1.3 |
| Warning on the padlock (mixed content) | Images or files loaded over http | Load everything over https |
If only some visitors see the error, the cause is usually on their side: a wrong device clock, a hotel or café Wi-Fi login page they have not passed yet, or antivirus software inspecting HTTPS. Ask them to check the clock and try another network.
How to test your SSL certificate
Having a certificate installed is not the same as having it installed correctly. A few minutes of checks will catch problems before your visitors do:
- In the browser: click the icon next to the address bar and open the certificate details. You will see who issued it, when it expires and which hostnames it covers.
- With SSL Labs: Qualys' free SSL Server Test checks the certificate chain, supported TLS versions and cipher settings, then grades the result from A to F. Aim for an A.
- For every hostname: test both
yourdomain.comandwww.yourdomain.com, plus any booking or payment subdomain. - For mixed content: open the page and look at the browser's developer console; anything loaded over http shows up as a warning.
Checking the expiry date once is not enough. If auto-renewal breaks, you only find out when the certificate expires, so tie expiry monitoring to an uptime tool or your calendar.
Moving your site to HTTPS properly
- Install the certificate for both the bare domain and www.
- Redirect every HTTP URL to HTTPS with a 301.
- Make sure images, scripts and internal links load over https.
- Update canonical tags and your sitemap.
- Verify the https property in Google Search Console and submit the sitemap.
- Once everything works, add an HSTS header so browsers only connect over HTTPS.
- Run the tests above and put a renewal check in your calendar.
Google confirmed in 2014 that it uses HTTPS as a light ranking signal, and a move done with proper redirects does not cost you rankings. When you change hosting, the certificate has to be set up again; see our website migration guide.
Who is responsible for the certificate?
Many problems are not technical at all. When the domain sits with one company, hosting with another and the site with an agency, everyone blames someone else when the certificate expires. Know in writing who installed it, which panel renews it and who gets the expiry warnings. Warnings going to a former employee's inbox is something we see often. Keeping certificate details in the same document as your domain and hosting details avoids the confusion.
Common mistakes
- Covering the domain but forgetting www.
- Letting the site load on both http and https without a redirect.
- Discovering auto-renewal broke only when the certificate expires.
- Not tracking the certificate on a separate booking or payment subdomain, so the main site looks fine while checkout fails.
- Leaving hard-coded http image links in templates.
- Paying for an expensive certificate you do not need.
In Antalya most bookings arrive between June and September. A hand-renewed certificate that expires in August means a full-screen warning in the busiest weeks, which is why auto-renewal and expiry monitoring belong near the top of any pre-season checklist.
When choosing a host, ask about free automatic SSL; we cover that in how to choose web hosting. A free SSL certificate is included in our maintenance and hosting service, and HTTPS redirects are part of the maintenance work. See what is covered in our packages, or use the quote wizard to find the right option in a few steps.
Frequently asked questions
Are SSL and TLS the same thing?
In practice, yes. TLS is the modern, secure successor to SSL, and the old SSL protocols were retired years ago. The name "SSL certificate" stuck; every certificate you buy today works with TLS.
Is a free SSL certificate good enough?
For business sites and most online stores, yes. Free DV certificates such as Let's Encrypt provide the same encryption as paid DV certificates; the difference is support, warranty and validation type.
Does SSL affect Google rankings?
HTTPS has been a light ranking signal since 2014. The bigger effect is indirect: visitors who see a security warning leave.
Why does my certificate renew every few months?
Under a CA/Browser Forum decision, the maximum lifetime is 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029, so renewal has to be automated.
How do I check that my SSL certificate is valid?
Click the icon next to the address bar and open the certificate details: you will see who issued it, when it expires and which hostnames it covers. For a deeper check, run a free test such as SSL Labs.
Only some visitors see the error. Why?
Usually it is on their device: a wrong date and time, a hotel or café Wi-Fi login page, or antivirus software that inspects HTTPS traffic.
Will moving from HTTP to HTTPS hurt my SEO?
Not if done properly: redirect every HTTP URL to its HTTPS version with a 301 and update internal links and your sitemap.
