What an SSL certificate actually protects

You’ve seen the warning: “Your connection is not private.” That’s your browser refusing to trust a site whose SSL certificate is expired, misconfigured, or missing. Here’s what’s actually going on underneath.

What SSL does

An SSL/TLS certificate does three things:

1. Encrypts the connection. Everything between the visitor’s browser and your server is scrambled. A café Wi-Fi attacker can’t read passwords or form data in transit.
2. Proves identity. The certificate is issued by a certificate authority (CA) that verifies you control the domain. That’s why the browser can say “this is really yourwebsite.com.”
3. Enables trust indicators. The padlock, https:// in the address bar, and — increasingly important — trust from search engines and browsers.

What SSL does NOT do

This is where the confusion starts:

• It does not make your server unhackable. Encryption protects data in transit, not the server itself.
• It does not protect against malware on your site, SQL injection, or a stolen password.
• It does not mean your site can’t be spoofed — lookalike domains like yourwebsite.xyz can have their own perfectly valid certificates.

Think of SSL as a sealed envelope, not a safe.

The expired certificate emergency

An expired certificate is more damaging than most people expect:

• Visitors get full-page warnings — most of them leave.
• The site may break entirely for API calls, forms, and payment integration.
• SEO suffers. Google treats a broken HTTPS connection as an untrustworthy signal.

Renewal is exactly the kind of thing that “we set it up once” misses. Certificates expire; somebody has to renew them on a calendar.

How certificates are issued now

Gone are the days of paying yearly for a certificate. Let’s Encrypt issues free certificates that auto-renew, and most modern setups handle renewal entirely automatically. If your site is still on a paid, manually renewed certificate, that’s a maintenance smell worth fixing.

The checklist

• Every page loads over HTTPS — no mixed content
• Certificate covers all subdomains (www included)
• Auto-renewal is configured and actually tested
• HTTP is redirected to HTTPS with a 301

The one-sentence version: SSL encrypts the connection and proves identity — and because it expires, keeping it alive is a maintenance task, not a one-time setup.