SSL/TLS Certificates Explained: How HTTPS Works

By Alex Rivera Jul 11, 2026 9 min read Cybersecurity

SSL/TLS certificates are what make the padlock icon appear in your browser. They encrypt communication between your browser and websites, protecting your data from interception.

What Is SSL/TLS?

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are cryptographic protocols that secure internet communication. When a website has HTTPS in its URL, it is using TLS. The protocol authenticates the server, encrypts data in transit, and ensures data integrity.

How HTTPS Works

When you visit an HTTPS website, the browser and server perform a TLS handshake. The server presents its SSL certificate containing its public key. The browser verifies the certificate against trusted Certificate Authorities. A symmetric session key is exchanged using asymmetric encryption. All subsequent data is encrypted with this session key using AES.

Types of SSL Certificates

Domain Validation (DV): Basic validation, simple to get, shows padlock in browser. Organization Validation (OV): Validates organization identity, used by businesses. Extended Validation (EV): Highest level, shows organization name in address bar, now being phased out by browsers. Wildcard: Secures a domain and all subdomains. Multi-Domain: Secures multiple domains with one certificate.

How to Get an SSL Certificate

Use Let's Encrypt for free DV certificates with Certbot automation. Purchase from providers like DigiCert, Sectigo, or GoDaddy for OV and EV certificates. Cloud providers (Cloudflare, AWS, Azure) offer free SSL through their platforms. Self-signed certificates work for testing but trigger browser warnings.

Setting Up with Certbot

Install Certbot on your server. Run sudo certbot --nginx -d example.com -d www.example.com. Certbot automatically obtains and installs the certificate. Set up auto-renewal: sudo certbot renew. Certificates are valid for 90 days. Certbot handles the renewal process automatically.

Common SSL/TLS Issues

Expired certificates: check renewal is working. Mixed content: HTTP resources on HTTPS pages cause warnings. Certificate name mismatch: ensure the certificate covers your domain. Missing intermediate certificates: the server must send the full certificate chain. Weak cipher suites: disable SSLv3, TLS 1.0, and TLS 1.1.