An SSL certificate was an optional luxury 10 years ago. Today it is a mandatory minimum. This article explains the types, selection, and practical deployment for a business owner.

For broader cybersecurity context, see the pillar Cybersecurity of Company Data. For the glossary entry, see /en/glossary/ssl.

What Is SSL/TLS

SSL (Secure Sockets Layer) is the original protocol from 1995 for encrypted internet connections. TLS (Transport Layer Security) is its modern version (TLS 1.0 from 1999; in 2026 the minimum is TLS 1.3).

In practice, SSL and TLS are used interchangeably — when we talk about an “SSL certificate”, we mean a TLS certificate. “SSL” remains as a marketing term.

Three Functions

  1. Encryption — communication between browser and server is encrypted. An attacker in the middle (for example on Wi-Fi in a café) cannot see the transmitted data — passwords, forms, cookies.
  2. Integrity — a cryptographic hash ensures that an attacker cannot alter content during transmission (e.g. inject adverts or malware into a legitimate website).
  3. Authentication — the certificate confirms that the server is genuinely what it claims to be. Without this, an attacker could create a fake site and redirect visitors there.

HTTPS = HTTP + TLS

HTTPS (HTTP Secure) is the HTTP protocol running over TLS. In the browser’s address bar you see a padlock and https:// instead of http://.

In 2026, every serious website uses HTTPS. HTTP-only sites:

  • Browsers display a “Not Secure” warning
  • Search engines penalise rankings
  • Some APIs and integrations fail
  • Cookies cannot be set as secure

Types of SSL Certificates

Three categories by validation level:

Domain Validation (DV)

Simplest — the Certificate Authority (CA) verifies only that the applicant owns the domain (via DNS record or file on server). Does not concern itself with company identity.

  • Cost: Free (Let’s Encrypt) or 5–30/year
  • Validation: Automated, takes minutes
  • Suitable for: Marketing sites, blogs, informal pages

Organisation Validation (OV)

The CA also verifies company identity (commercial register, phone call, documents).

  • Cost: 50–200/year
  • Validation: 1–3 days
  • Suitable for: B2B websites where clients appreciate company verification

Extended Validation (EV)

The strictest validation — the CA verifies the company through rigorous verification (personal visit, legal declaration, etc.).

  • Cost: 100–500/year
  • Validation: 1–2 weeks
  • Suitable for: Banks, financial institutions, large e-commerce sites

In 2026, EV certificates are less visible — modern browsers no longer show the company name in the address bar (the green panel from the past). EV has lost most of its UX benefit and remains only as a legal signal.

Special Types

Wildcard Certificate

Covers all subdomains of one domain: *.modulario.com covers www.modulario.com, app.modulario.com, api.modulario.com, etc.

Cost: 50–300/year. Alternative: Let’s Encrypt + DNS-01 challenge automation (more complex setup, but free).

Multi-Domain (SAN)

One certificate for multiple different domains (company1.com + company2.com + company3.com).

Cost: 50–500/year depending on number of domains.

Code Signing

Not for web — used for signing software packages (.exe, .msi, drivers). Without a code signing certificate, Windows displays “Unknown publisher” during installation.

Let’s Encrypt: Free and the Practical Choice

Let’s Encrypt is a non-profit Certificate Authority launched in 2016 (ISRG, sponsored by EFF, Mozilla, Cisco, and others). It issues free DV certificates with 90-day validity + automatic renewal.

In 2026, they issue more than 50% of all SSL certificates in the world.

Advantages

  • Free — regardless of number of domains
  • Automated — Certbot renews certificates automatically
  • Widely supported — all browsers recognise Let’s Encrypt
  • No encryption compromise — same TLS 1.3 as paid certificates

Limitations

  • DV only (no OV or EV)
  • 90-day validity (must be renewed every 60 days)
  • No “support phone line” — community based

Installation

For most hosting providers (including WebSupport, Active24, and similar), Let’s Encrypt is available in the admin panel with one click. For your own server via Certbot:

sudo certbot --nginx -d company.com -d www.company.com

Auto-renewal via systemd timer or cron — set-and-forget for a year ahead.

SSL Implementation for a Business Website

Step 1: Domain

The domain must be registered. Cost: 10–30/year.

Step 2: Hosting or Server

Hosting (cloud SaaS, VPS, dedicated) must support HTTPS. All modern hosting providers in 2026 do.

Step 3: DNS Configured

A record company.com points to the server’s IP, AAAA for IPv6.

Step 4: Certificate

  • Hosting panel: click “Enable SSL” — Let’s Encrypt automatically
  • Own server: Certbot installation
  • Cloud (AWS, Azure): certificate manager, sometimes free, sometimes included in load balancer

Step 5: Force HTTPS

The site must redirect http://company.com to https://company.com. In Apache .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

For Nginx or cloud load balancer, equivalent configuration.

Step 6: HSTS

HSTS (HTTP Strict Transport Security) enforces HTTPS even on the first visit. Header:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Step 7: Test

Test via SSL Labs Server Test. Target: grade A or A+.

Expiry Monitoring

The most common mistake: the certificate expires and nobody noticed → the site stops working reliably.

Solutions:

  • Let’s Encrypt + Certbot auto-renewal — automatic, no manual step needed
  • Uptime Robot, Pingdom — alert 30 days before expiry
  • Site24x7, StatusCake — broader monitoring including SSL
  • Custom cron with openssl s_client -connect company.com:443 parsing

For Modulario, SSL monitoring is part of the overall infrastructure. Clients never have a problem with an expired SSL on the main domain.

TLS 1.3 and Modern Standards

In 2026, TLS 1.3 is the minimum. Older versions:

  • TLS 1.0 and 1.1 — deprecated since 2020, prohibited
  • TLS 1.2 — still supported for legacy clients, but not the default
  • TLS 1.3 — default, fastest, most secure

Server configuration should:

  • Enforce TLS 1.2 minimum (ideally 1.3 only)
  • Disable weak ciphers (RC4, DES, 3DES)
  • Have OCSP stapling
  • Support HTTP/2 and HTTP/3 (QUIC)

SSL Labs test will reveal all deficiencies.

Frequently Asked Questions

What does an SSL certificate do? An SSL/TLS certificate secures encrypted communication between a visitor’s browser and your web server (HTTPS instead of HTTP). Three functions: (1) encryption — nobody ‘in the middle’ can intercept data (passwords, forms), (2) integrity — an attacker cannot alter content in transit, (3) authentication — the visitor knows they are communicating with the correct server, not a fraudulent one. Without SSL, browsers display a ‘Not Secure’ warning, which destroys business credibility.

Is a free SSL from Let’s Encrypt enough, or do I need a paid one? For 95% of business websites, Let’s Encrypt is sufficient — free, automatically renewable, technically the same encryption as paid certificates. A paid certificate makes sense only for: (1) Extended Validation (EV) certificate for banks or high-volume e-commerce, (2) Wildcard for many subdomains, (3) Organisation Validation (OV) for B2B businesses where clients verify legal identity. For SMB owners, Let’s Encrypt + auto-renewal via Certbot is the optimal solution.

What happens when an SSL certificate expires? Browsers display an aggressive warning ‘Your connection is not private’ and most visitors leave the site. For a B2B business, this means loss of credibility, lead generation outage, and potential loss of business. Some applications (banking, M365) stop communicating with a server whose certificate has expired. Solution: expiry monitoring (Uptime Robot, Pingdom, or Certbot auto-renewal) — alert 30 days before expiry.