How HTTPS and SSL certificates work

The padlock in your browser tells you the connection to a site is encrypted and that the site proved who it is. Behind that small icon is a system of certificates, authorities and expiry dates. Understanding it helps both when you see a warning as a visitor and when you run a site and want to avoid an embarrassing outage.

What HTTPS adds

HTTP is the language browsers and servers use. HTTPS is the same language wrapped in encryption, using a protocol called TLS. (SSL is the older name, still widely used in everyday speech.) The wrapper provides three things:

  • Privacy. Anyone watching the network sees scrambled data, not your passwords or card details.
  • Integrity. The data cannot be altered on the way without detection.
  • Identity. The server proves it is the site you meant to visit, and not an impostor.

What a certificate is

A certificate is a small digital document that ties a website’s name to a cryptographic key. It states which names it covers, who issued it, and the dates between which it is valid. The server presents it at the start of every secure connection.

Who vouches for it

Anyone can create a certificate that claims to be for any name. What makes one trustworthy is the signature of a certificate authority, an organisation that checks the applicant controls the name before signing. Your browser and operating system ship with a list of authorities they trust. When a site presents a certificate, the browser checks that it is signed by one of them, directly or through a chain of intermediate certificates.

What your browser checks

  1. The name matches. The certificate must cover the exact address you typed.
  2. It is within its dates. Not yet valid and expired certificates both fail.
  3. It is signed by a trusted authority, with a complete chain.
  4. It has not been revoked, meaning cancelled early by the issuer.

Fail any of these and you see a full-page warning. See SSL certificate errors explained for what each message means.

Why certificates expire

Certificates are deliberately short-lived. If a key is stolen or a site changes hands, the old certificate stops being valid soon on its own. Lifetimes have been getting shorter across the industry, so renewal needs to be routine, not a yearly scramble. Free authorities issue certificates valid for a matter of weeks to months, with tools that renew them automatically.

The most common certificate outage

An expired certificate is one of the most common and most avoidable causes of a site becoming unusable. The site is running, the server is healthy, but every visitor gets a security warning. It usually happens because a manual renewal was forgotten, an automatic renewal quietly failed, or a certificate on a less obvious system, such as an API or a mail server, was missed.

Avoiding it

  • Automate renewal, and check it actually ran.
  • Monitor expiry dates and alert at least two weeks ahead. Our SSL certificate checker shows the date for any site.
  • List every certificate you rely on, including subdomains, APIs and email.
  • Serve the full chain, not just your own certificate, or some devices will reject it.
  • Cover every name you use, including the version with and without www.
  • Redirect HTTP to HTTPS so visitors always end up on the secure version. Our redirect checker can confirm it.

Related protections

Once HTTPS works, there are extra headers that tell browsers to behave safely, for example always use HTTPS for your site, or restrict where scripts can load from. You can review them with our security headers checker.

For visitors: what to do about a warning

  • Check your device’s date and time first. A wrong clock is a common cause.
  • Try another network. Public Wi-Fi can interfere with secure connections.
  • If the warning appears on a site you trust and nobody else sees it, your network or device is the likely cause.
  • If it appears for everyone, the site has a problem. Do not enter passwords or payment details until it is fixed.

Summary

HTTPS encrypts the connection and a certificate proves the site’s identity. Certificates are vouched for by trusted authorities and are valid only for a limited time. Most certificate problems are expiry, a mismatched name or an incomplete chain, and all three are easy to prevent with automatic renewal and monitoring.

Check a website now

Is it down for everyone, or just you? Paste an address and we test it from fifteen places.

Open the checker

Related guides

Last updated 2 November 2026. Written by the siteupdown.com team. Spotted a mistake?

← All help guides