Article SSL & Security

What an SSL certificate actually does

The padlock explained plainly: what a certificate actually verifies, what it encrypts, and the questions it was never built to answer.

iFastHosting Support Team Updated 26 August 2026 8 min read Beginner

The padlock icon next to a web address is one of the most widely recognised symbols on the internet, and also one of the most widely misunderstood. Most people read it as "this site is safe". That is not what it means, and the gap between those two ideas is worth closing, because it changes how much weight you should put on it.

An SSL certificate does two specific, verifiable things. It does not vouch for the content of a site, the honesty of the business running it, or the quality of its code. Understanding the difference matters whether you are installing a certificate on your own site or deciding how much to trust one on somebody else's.

What SSL and TLS actually are

SSL is the name everyone still uses, but the protocol doing the work today is TLS — Transport Layer Security, the successor to SSL. The terminology stuck around long after the technology moved on, so "SSL certificate", "TLS certificate" and simply "HTTPS" all refer to the same thing in practice.

A certificate is a small signed file issued by a certificate authority. When a browser connects to a server that presents one, the two sides perform a handshake: the server proves it holds the private key matching the certificate, they agree on encryption keys for that session, and from that point on everything sent between them is encrypted. Anyone intercepting the traffic in between — a network operator, a public Wi-Fi hotspot, an internet service provider — sees only scrambled data, not the actual request or response.

The two things a certificate proves

Strip away the marketing and a certificate makes exactly two claims:

The connection is encrypted. Nobody sitting on the network path between the visitor and the server can read or silently alter the data in transit.
The domain belongs to whoever requested the certificate. At minimum, the certificate authority confirmed that the requester controls the domain the certificate covers.

That second point is exactly as strong, or as weak, as the level of validation behind it — and validation level is where certificates genuinely differ from each other.

Domain, organisation and extended validation

Certificate authorities issue three broad classes of certificate, distinguished by how much checking happens before the certificate is signed.

Type	What is checked	Typical use
Domain Validation (DV)	Only that the requester controls the domain, usually confirmed automatically via DNS or a file on the server.	The default for most websites. Issued in minutes, including all free certificates.
Organisation Validation (OV)	Domain control plus a manual check that the requesting organisation is a real, registered entity at a verifiable address.	Business sites that want the organisation's identity recorded in the certificate itself.
Extended Validation (EV)	The most thorough manual check: legal existence, physical address and operational status of the business.	Historically favoured by banks and large retailers.

All three encrypt the connection identically. The difference is entirely in what was checked about the requester before issuing, and how much of that appears in the certificate's own details if someone inspects it. Modern browsers no longer display a distinct visual indicator for OV or EV certificates — the address bar treatment is the same padlock across all three — so the extra validation is only visible to someone who deliberately opens the certificate details.

What it does not do

This is the part the padlock does not communicate, and it is the reason "the site has a certificate" is a poor test of whether a site can be trusted.

It says nothing about the site's content. A phishing page can have a perfectly valid DV certificate, because DV only checks domain control, and anyone can register a domain.
It does not mean the software behind it is secure. An encrypted connection to a website running out-of-date, vulnerable software is still an encrypted connection to a vulnerable website.
It is not a malware scan. A certificate authority checks the domain, not the files being served from it.
It does not replace backups, updates or good passwords. Encryption in transit and the overall security of a site are separate concerns, both of which matter.

What the padlock reliably tells you

Treat it as proof that your connection to that specific domain has not been intercepted or tampered with on the way there — nothing more. It is a necessary property of a trustworthy site, not a sufficient one.

Why every site needs one regardless

Given those limits, a certificate might sound like a low bar. It is still an essential one, for reasons that have little to do with trust signalling.

Browsers actively warn visitors away from sites that do not have one. Any page with a login form, a payment field or any other input served over plain HTTP is flagged directly in the address bar as not secure, which is enough to make a visitor leave before they read another word. Password managers and browser autofill increasingly refuse to operate on unencrypted pages. Search engines have also treated HTTPS as a ranking signal for years, covered in more detail in whether HTTPS affects SEO. And without encryption, anything submitted through your site — a contact form, a login, an order — is genuinely readable by anyone positioned on the network in between, which is the actual, practical risk a certificate removes.

Getting one

You do not need to buy anything to have a working certificate. A free certificate is included on every hosting plan here and is issued automatically once your domain points at your hosting account — there is no separate purchase step for the everyday case of encrypting a website. How to install an SSL certificate walks through what to check if that has not happened automatically, and free SSL vs paid SSL covers the situations where paying for a higher validation level actually buys you something.