A browser shows a padlock icon next to the address bar for a practical reason, not decoration: it signals that the connection to the site is encrypted and the domain's certificate has been verified. For a site owner, an SSL certificate is not an optional extra — modern browsers directly warn a visitor about the risk when it is missing. This article explains what a certificate actually does and how to approach setting one up. It is worth sorting this out before a browser shows the warning to a real visitor of the site, not afterward, once complaints about distrust in the resource start coming in. That matters most for contact forms, an online store's checkout, and a personal account area — the absence of a certificate stands out immediately there.
What an SSL certificate does technically
A certificate solves two tasks at once. The first is encryption: data between the browser and the server travels over the TLS protocol rather than in plain text, so intercepting traffic at an intermediate node does not let anyone read the content. The second is identity verification: the certificate is issued by a certificate authority and confirms that the domain really belongs to whoever manages it, rather than to a server impersonating it in the middle.
Without a certificate a site runs over HTTP on port 80; with a certificate it runs over HTTPS on port 443. Modern versions of the protocol, TLS 1.2 and TLS 1.3, are supported by practically every browser and server.
What a visitor sees on a site without a certificate
Browsers stopped simply showing a site without a padlock a long time ago — they warn about the risk directly on the page, before a person even sees the content.
curl -I http://example.com
HTTP/1.1 200 OKThat server response contains no error by itself, but it shows that the connection is not encrypted — in that case the browser will mark the site as not secure right in the address bar. The steps for attaching a certificate to such a domain are described in the article "How to connect SSL".
Why a certificate matters beyond security
Encryption is not the only reason a certificate has become a required part of a site.
| Reason | Without a certificate | With a certificate |
|---|---|---|
| Display in the browser | Warning about an unsecured connection | Padlock icon, connection trusted by default |
| Forms with passwords and payments | Many browsers block form submission | The form works with no extra warnings |
| Treatment by search engines | Counted as a ranking factor against the site | Counted as a ranking factor for the site |
| Compatibility with modern protocols | HTTP/2 requires HTTPS in practice | HTTP/2 and newer protocols are available |
Practical certificate setup through Nginx and Certbot is covered in the article "SSL in Nginx with Certbot".
Which type of certificate fits a domain
The choice depends on how many domains and subdomains need to be protected at once:
- A single certificate for a single domain fits a simple site with no subdomains
- A certificate with several names (SAN) covers the main domain and several additional ones at once
- A wildcard certificate protects a domain and all of its subdomains with one issuance
Setting up a wildcard certificate through Certbot is described in detail in the article "Setting up Certbot for a wildcard certificate".
What to do: the order of connecting a certificate to a domain
To move to HTTPS without surprises, it helps to follow a specific sequence.
- Confirm that the domain's DNS record points to the right server — the certificate is issued specifically for that address
- Choose how to obtain the certificate: automatically through Certbot or from a specific certificate authority
- Issue the certificate and attach it in the web server's configuration on port 443
- Set up an automatic redirect from HTTP to HTTPS so port 80 does not remain an unencrypted entry point
- Check the certificate's validity period and set up automatic renewal to avoid running into an expired certificate later
Frequently asked questions
How much should an SSL certificate cost for a domain?
The cost depends on the certificate authority and the certificate type, and some providers issue basic certificates for free through automated certification authorities. Before choosing, it helps to compare specific offers rather than rely on averaged figures.
Can a site skip an SSL certificate if it is just a simple brochure site?
Technically the site will still work without a certificate, but the browser will show a warning about an unsecured connection, which lowers visitor trust even for a simple informational page.
What happens when a domain's certificate expires?
The browser blocks access to the site with a warning about an invalid certificate until it is renewed or reissued. That is why automatic renewal is a required part of the setup, not an optional one.