SSL/TLS Certificates Explained for Business Owners

A padlock icon is not a character reference

Look at your browser's address bar right now. There is almost certainly a small padlock or a "tune" icon next to the web address. Click it, and most browsers will tell you the connection is "secure." That word does a lot of quiet persuading. It does not mean the site is safe, honest, or run by a real business. It means something much narrower: your connection to that specific server is encrypted, and the server proved it controls the domain name in the address bar. That is the whole promise. Understanding exactly where that promise starts and stops is worth ten minutes of any business owner's time, because getting it wrong — either by over-trusting the padlock or under-investing in the certificate behind it — causes real problems.

Two separate jobs: scrambling data, and proving identity

An SSL/TLS certificate does two distinct things, and it's worth separating them because certificate types differ mainly in how seriously they take the second one.

Encryption in transit means that data moving between a visitor's browser and your server is scrambled so a third party intercepting it — on public wifi, on a compromised router, anywhere along the path — cannot read it. This is the part every certificate provides, regardless of type or price.

Identity verification is the separate question of who actually holds that certificate, and how hard anyone checked. This is where certificates split into three tiers:

• Domain Validated (DV) certificates confirm only that whoever requested the certificate controls the domain — usually proven by placing a file on the server or a DNS record. No company details are checked at all. DV certificates can be issued in minutes, automatically, with no human review.
• Organisation Validated (OV) certificates additionally confirm the legal existence of the business requesting the certificate against official records, which takes longer and typically costs money.
• Extended Validation (EV) certificates go further still, with more rigorous vetting of the legal entity, physical address and operational existence of the business.

For years, EV certificates displayed the company's verified legal name in green text in the browser bar — the clearest signal a browser has ever given about business identity. That signal is gone. Chrome removed it starting with Chrome 77 in September 2019, and Firefox followed with version 70 the following month, after both vendors' security teams concluded users weren't noticing or acting on the indicator, and that the space was better used for other warnings (Computerworld; Mozilla Bugzilla, "Move EV cert UI out of URL Bar"). Today, DV, OV and EV certificates render identically in the address bar of every mainstream browser. The organisation details an OV or EV certificate carries are still real and still checkable — but only if a visitor deliberately clicks through to the certificate's connection details, which almost nobody does. If your reason for wanting OV or EV is "so visitors see we're a verified company," that reason no longer holds in the browser chrome itself. It may still matter for other uses, such as some payment processors or partners that check certificate details programmatically, but decide with that context in mind rather than the old assumption about visible trust signals.

Free and automatic is now the default, not the exception

For most of the web's history, certificates were a paid, manual, once-a-year chore. That changed with Let's Encrypt, a nonprofit certificate authority that issues free DV certificates using the ACME protocol — software on your server proves it controls the domain (via a file placed at a specific path, a DNS record, or a special TLS handshake), and a certificate is issued and installed with no human involved on either side (Let's Encrypt, "How It Works"). Most reputable hosts now automate this end to end. If your host or developer is still charging you separately every year for a basic DV certificate and doing it manually, ask why — for the majority of ordinary business websites, that cost and manual step are no longer necessary.

Certificates now expire faster — and expiry is a genuinely common cause of outages

Automation matters more than ever, because certificate lifespans are shrinking. The CA/Browser Forum — the body of certificate authorities and browser vendors, including Apple, Google, Mozilla and Microsoft, that sets these rules — approved a phased reduction from the long-standing maximum of 398 days down to 47 days by 2029. The first step took effect on 15 March 2026, cutting the maximum validity to 200 days; it drops again to 100 days in March 2027, and to 47 days in March 2029 (CA/Browser Forum, Ballot SC-081v3; Sectigo, "200-Day SSL Certificate Expiration Risk"). Some major issuers moved even earlier than required — DigiCert began capping new certificates at 199 days from 24 February 2026, ahead of the deadline.

The practical consequence: a certificate that used to need renewing once a year will soon need renewing every one to two months. A site running on manual renewal is now several times more exposed to the single most avoidable cause of a "site down" or "connection not private" incident — someone simply forgetting to renew before expiry. This is not a hypothetical; expired certificates are a routine, entirely preventable cause of business websites going dark, usually discovered when a customer calls to say the site is throwing a security warning. Automated renewal, checked periodically rather than assumed to be working, is no longer optional best practice — it's close to a requirement given how often the renewal clock now resets.

Mixed content: when "secure" has an asterisk

A page served over HTTPS that then loads an image, script, or embed over plain HTTP creates "mixed content." Modern Chromium-based browsers automatically try to upgrade some mixed content — images, audio and video — to HTTPS silently, and if that upgrade fails, the resource simply won't load. Other mixed content, such as scripts, stylesheets and iframes, is blocked outright with no upgrade attempt, because it's considered higher-risk ("blockable" content, in Chromium's terminology) (Chromium documentation, "Mixed content Autoupgrade"). Either way, the visible result for a business owner is the same: broken images, missing embeds, or a warning icon in the address bar — usually because an old page, an embedded widget, or a hardcoded image URL was written with an http:// address instead of https:// years ago and never updated.

HSTS: telling browsers not to bother asking again

HTTP Strict Transport Security (HSTS) is a response header a server sends that instructs the browser to remember, for a set period, that this domain should only ever be reached over HTTPS — never plain HTTP, even if a link or bookmark points to the HTTP version. Once a browser has seen this header, it will not let a visitor click through security warnings on that domain, and it closes off a specific attack where someone intercepts the very first request to silently downgrade a connection to unencrypted HTTP (MDN, "Strict-Transport-Security header"). It's a small, one-time configuration change with a real security benefit, and it's frequently absent on smaller business sites simply because nobody set it.

What none of this tells you

Here is the part worth repeating plainly: a valid certificate, a padlock, and even "https://" in the address bar say nothing about whether a site is trustworthy, legitimate, or safe to enter payment details into. Free, automated DV certificates mean anyone — including someone running a phishing site — can have a fully valid, browser-trusted padlock in minutes, at no cost, with no identity check whatsoever. Phishing-infrastructure researchers have reported for several years running that the majority of phishing sites now use valid HTTPS certificates, precisely because a padlock reassures visitors (PhishLabs, "More Than Half of Phishing Sites Now Use HTTPS"). HTTPS is a baseline hygiene requirement, not a trust badge. Treat it as necessary and unremarkable — and keep your actual trust signals (who you are, what you claim, how customers can verify you) somewhere a certificate was never designed to carry them.

Getting the basics checked

None of the above requires a large project to fix — it usually requires someone to actually look: is renewal automated and monitored, is there leftover mixed content from an old redesign, is HSTS configured, is the certificate type appropriate for what the site actually needs. JagaWeb's Essential System Review (RM1,500, reduced to RM999 until 16 September 2026) covers this as one of eight fixed control points across a site of up to 25 pages, with a decision-ready report and a 30-day action plan — no ongoing commitment, and the fee is credited toward eligible follow-on work for 12 months if you choose to act on the findings. Details and contact at jagaweb.my, or reach us directly at sales@jagaweb.my, or on WhatsApp through jagaweb.my.