Certificates and What You Actually Need

What a certificate actually does

Two things, and conflating them causes most of the confusion.

It enables encryption between the visitor's browser and the server, so what is transmitted cannot be read in transit.

It confirms something about identity, at minimum that whoever obtained it controls the domain.

The encryption is identical regardless of what you paid. A free certificate and an expensive one use the same protocols and provide the same protection.

What differs between tiers is how much was verified before issuance, and what commercial terms accompany it.

The validation levels

Domain validation confirms control of the domain, is issued automatically, and is what free certificates provide. It is what nearly every small business needs.

Organisation validation involves checking that the organisation exists, which puts verified details into the certificate that almost nobody looks at.

Extended validation involves more thorough checks. It once produced a distinctive visual indicator in browsers, and browsers have largely removed that display, which substantially reduced the practical argument for it.

The consequence is that the visible difference to a visitor is now essentially nil across all three, which is worth knowing before paying for the upper tiers.

Free certificates

Widely used, automatically issued, and short-lived by design, which means renewal has to be automatic.

Most hosting control panels now include this and enable it by default, which is why many small businesses have a certificate they never thought about.

The trade is that they last a short period and renew frequently. When automation works, that is invisible. When it fails, the site produces a security warning within days rather than giving months of grace.

Which makes monitoring the expiry the practical requirement rather than choosing a different certificate.

When paying is justified

Narrower than vendors suggest and not nothing.

• A client or contract requires it, which happens in some procurement.
• You need a wildcard covering many subdomains and your host does not provide one free.
• Your environment cannot automate renewal, making a longer-lived certificate practical.
• You want the warranty, which is a commercial term rather than a security feature and rarely pays out in ways that matter to a small business.

For an ordinary local business site, none of those applies and the free certificate is the correct answer.

The failure that actually happens

Expiry, and it is the most common certificate problem by a wide margin.

An expired certificate produces a full-page browser warning that most visitors will not click through, which means the site is effectively down while being technically fine.

It also affects email and anything else using the certificate, which surprises people who assume it is a website matter.

The protections: automatic renewal, external monitoring that checks the certificate rather than only whether the site responds, and a calendar reminder as a backstop.

Monitoring services check expiry as standard and will warn weeks ahead, which converts a crisis into a task.

Mixed content

The other common problem, and it produces a subtler failure.

A page served securely that loads an image, script, or stylesheet over an insecure connection is mixed content. Browsers either block it or downgrade the security indicator, which means a site with a valid certificate can still show a warning.

Usual causes: hard-coded addresses in content written before the certificate was installed, an embedded resource from a third party, and theme or plugin references that were never updated.

The browser console reports these specifically, which makes them straightforward to find once somebody looks.

Redirects and consistency

Having a certificate is not the same as using it.

The secure version should be the only version, with everything else redirecting to it: the insecure address, and the variant with or without the leading prefix, whichever you do not use.

Without that, both versions exist, which splits how the site is understood and leaves the insecure one reachable.

The related setting instructs browsers to use the secure version automatically in future, which is worth enabling once you are confident everything works, since it is difficult to reverse quickly.

The check worth running

1. Confirm the certificate is valid and note the expiry date.
2. Confirm renewal is automatic, rather than assuming.
3. Set up monitoring that watches expiry.
4. Check for mixed content in the browser console.
5. Confirm the insecure version redirects, and that only one address variant is live.

That takes fifteen minutes and prevents the failure that takes a site off entirely, which sits alongside the other settings that protect the domain itself, as covered in locking down the domain itself.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.