What is an SSL cer­tifi­cate? De­f­i­n­i­tion, validity, and costs

An SSL cer­tifi­cate is a digital file that confirms a website’s identity and enables an encrypted con­nec­tion between the server and browser. It protects sensitive data like passwords from third-party access. Websites with an SSL cer­tifi­cate can be iden­ti­fied by the “https” in the URL and a small padlock icon in the browser.

What is an SSL cer­tifi­cate?

Modern SSL cer­tifi­cates no longer use the outdated SSL (Secure Sockets Layer) but instead rely on the newer and more secure TLS (Transport Layer Security). In practice, however, “SSL cer­tifi­cates” is still the common term when referring to securing a website and server with en­cryp­tion tech­nol­o­gy. The cer­tifi­cate itself is a simple data record: the file contains numerous details, such as the issuer’s name, the serial number, and the so-called fin­ger­print for en­cryp­tion. Cer­tifi­cates come in various file formats and must be installed on the server for use.

To obtain an SSL cer­tifi­cate, website operators must contact a cer­ti­fi­ca­tion authority. These or­ga­ni­za­tions are au­tho­rized to issue an SSL cer­tifi­cate but typically charge a fee for their service. But why can’t just anyone set up their own or­ga­ni­za­tion? The reason for this is that browser man­u­fac­tur­ers, like Microsoft, Mozilla, or Google, must accept the cer­tifi­cates; otherwise, the cer­tifi­cate would be utterly useless.

How long is an SSL cer­tifi­cate valid?

A cer­tifi­cate accepted by browsers is not valid in­def­i­nite­ly. Each SSL cer­tifi­cate has an ex­pi­ra­tion date between 1 and 13 months. By 2029, SSL cer­tifi­cates are expected to be valid for a maximum of 47 days. When this occurs, website operators must replace their expired SSL cer­tifi­cates and have them renewed; otherwise, the re­spec­tive sites will no longer be marked as par­tic­u­lar­ly secure. Although renewing cer­tifi­cates on a regular basis can be both time-consuming and costly, it remains essential. Only by having cer­ti­fi­ca­tion au­thor­i­ties re­peat­ed­ly verify integrity, identity, and the en­cryp­tion methods in use can user security be reliably ensured.

How does en­cryp­tion work for SSL cer­tifi­cates?

There are several methods for en­crypt­ing data transfers. Tra­di­tion­al­ly, a single key is used for both en­cryp­tion and de­cryp­tion, meaning the exact same key is required to make a message readable again. On the internet, however, this approach is im­prac­ti­cal since users often connect with people or or­ga­ni­za­tions they have never in­ter­act­ed with outside the web. As a result, there is no secure way to exchange a key without sending it un­en­crypt­ed over a public channel. For this reason, SSL cer­tifi­cates rely on a different en­cryp­tion method.

In a Public Key In­fra­struc­ture (PKI), two keys are generated: one public and one private. Messages encrypted with the public key can only be decrypted with the private key. The public key is trans­mit­ted to the browser via the SSL cer­tifi­cate and used for en­cryp­tion. Alongside this, the cer­tifi­cate also provides the browser with details about the supported en­cryp­tion methods.

A widely used method today is AES (Advanced En­cryp­tion Standard) combined with the SHA256 cryp­to­graph­ic hash function. However, en­cryp­tion standards evolve con­stant­ly—a method con­sid­ered secure today may be cracked tomorrow and deemed un­re­li­able.

What SSL cer­tifi­cates are there?

There are different types of SSL cer­tifi­cates. While issuers may vary in their ver­i­fi­ca­tion processes, these dif­fer­ences are not the main criteria. Instead, SSL cer­tifi­cates are primarily dis­tin­guished by the level of applicant ver­i­fi­ca­tion and the scope of coverage. Cer­tifi­cates in the Domain Val­i­da­tion category are now often available for free, but the costs of an Extended Val­i­da­tion cer­tifi­cate are usually too high for in­di­vid­u­als and small busi­ness­es.

Domain Val­i­da­tion (DV)

Domain Val­i­da­tion rep­re­sents the most basic level of SSL cer­tifi­cates, with ver­i­fi­ca­tion of the website owner being rather minimal. In many cases, the cer­ti­fi­ca­tion authority simply sends an email to the address listed in the WHOIS entry. The applicant may then be asked to modify a DNS record or upload a specific file to their server to confirm control over the domain.

Or­ga­ni­za­tion Val­i­da­tion (OV)

OV SSL cer­tifi­cates are one level higher in terms of visitor security. The cer­ti­fi­ca­tion authority requests documents from the website owners during the val­i­da­tion process—usually after the automated Domain Val­i­da­tion has taken place. The specific documents required depend on the issuing or­ga­ni­za­tion—often, a business reg­is­tra­tion is requested.

Ad­di­tion­al­ly, some cer­ti­fi­ca­tion au­thor­i­ties contact the website operators via phone. OV SSL cer­tifi­cates thus provide more security because there is more thorough vetting of who is truly behind the website. They also offer the advantage of keeping this in­for­ma­tion visible to users within the cer­tifi­cate itself.

Extended Val­i­da­tion (EV)

SSL cer­tifi­cates offered under the “Extended Val­i­da­tion” label represent the highest level of security. This type of cer­tifi­cate involves ver­i­fi­ca­tion of the domain and the as­so­ci­at­ed or­ga­ni­za­tion, as well as the applicant. It checks whether the applicant is indeed employed by the specified or­ga­ni­za­tion or company and whether they are au­tho­rized to request such a cer­tifi­cate.

Ad­di­tion­al­ly, the cer­ti­fi­ca­tion authority must also be au­tho­rized to conduct Extended Val­i­da­tion. To become au­tho­rized, the authority must pass a review by the CA/Browser Forum, which is a voluntary as­so­ci­a­tion of cer­ti­fi­ca­tion au­thor­i­ties and browser vendors.

What does an SSL cer­tifi­cate cost? Free SSL vs. paid SSL

A sig­nif­i­cant factor in cat­e­go­riz­ing and selecting an SSL cer­tifi­cate is the costs as­so­ci­at­ed with its ac­qui­si­tion. Relating this aspect directly to the three preceding ver­i­fi­ca­tion types, it can be generally stated that the more extensive the cer­ti­fi­ca­tion check, the more one must pay for the cer­tifi­cate in the end. Since 2015, Let’s Encrypt has even been a cer­ti­fi­ca­tion authority providing cer­tifi­cates com­plete­ly free of charge.

Dif­fer­ences between free and paid cer­tifi­cates

For the basic security of a website, ensuring it can be accessed via HTTPS instead of standard HTTP, a free cer­tifi­cate is just as effective as a paid one. Both types rely on SSL or TLS protocols, making secure data transfer mandatory between clients and servers.

In some aspects, however, free and paid cer­tifi­cates differ sig­nif­i­cant­ly from each other:

• Val­i­da­tion level: For SSL cer­tifi­cate issuance, ver­i­fi­ca­tion of the website owner is usually minimal—Domain Val­i­da­tion is the standard here. Cer­tifi­cates with higher security levels always require payment.

• Domain scope: A free SSL cer­tifi­cate is typically issued for a single domain without ad­di­tion­al technical effort and remains tied to it. Paid SSL/TLS solutions, however, also support cross-domain cer­tifi­cates that can secure multiple websites.

The ad­van­tages of paid SSL

Paid SSL cer­tifi­cates provide several ad­van­tages over free al­ter­na­tives, as already outlined in the previous section. Depending on the provider and plan, they can cover multiple domains with minimal effort. This not only improves flex­i­bil­i­ty but also reduces the overall ad­min­is­tra­tive workload. In case of issues, providers or cer­ti­fi­ca­tion au­thor­i­ties typically include per­son­al­ized support—a service that free SSL cer­tifi­cate users usually don’t receive.

Which cost model is the right one?

A paid SSL cer­tifi­cate with EV ver­i­fi­ca­tion is without doubt the optimal en­cryp­tion solution for a web project. However, this type of cer­ti­fi­ca­tion is usually only af­ford­able for larger companies, which are also the main target group in this case. More af­ford­able cer­tifi­cates are generally suf­fi­cient for web projects in the SME sector, as long as no highly sensitive data—such as in online banking—is trans­mit­ted. For smaller projects where the transfer of personal data plays little or no role, free SSL cer­tifi­cates are a good al­ter­na­tive to paid options. In any case, when choosing your SSL cer­tifi­cate, you should pay attention to the following points:

• Scope: Check how far the SSL cer­tifi­cate extends—for example, whether sub­do­mains are also covered.
• Single name: A standard cer­tifi­cate only applies to a single domain. This means that www.example.com and all subpages of this website are covered, but not sub­do­mains.
• Wildcard: These cer­tifi­cates use a wildcard (place­hold­er). Instead of only covering www.example.com, they also apply to all sub­do­mains.
• Multi-domain: Multi-domain cer­tifi­cates (also called SAN cer­tifi­cates) go far beyond the coverage of single-name or wildcard cer­tifi­cates. Many cer­ti­fi­ca­tion au­thor­i­ties offer cer­tifi­cates that can cover up to 100 domains.

How can you recognize an SSL cer­tifi­cate?

If you are using a modern browser, it’s easy to check whether a website is secured with SSL/TLS: just look at the address bar! Two in­di­ca­tors show that en­cryp­tion is active:

• a lock icon
• the address starts with https:// instead of the usual http://

The ad­di­tion­al “S” stands for Secure and signals to users that an ad­di­tion­al SSL/TLS layer has been added to the Hypertext Transfer Protocol. In the TCP/IP protocol stack, an extra en­cryp­tion layer has been inserted—between TCP and HTTP.

The lock icon is primarily an obvious signal from your browser that the website you’re visiting has a valid cer­tifi­cate. What many users don’t realize is that it’s also a button that leads to ad­di­tion­al security in­for­ma­tion about the website. Clicking it opens a pop-up window with details about the cer­tifi­cate issuer, the en­cryp­tion method used, and the cer­tifi­cate’s validity period.

Close

If the website you are visiting does not have a valid SSL cer­tifi­cate, you will see neither a lock icon nor https:// in the address bar. In addition, some browsers display warnings if users attempt to submit passwords or other sensitive data on such websites. The browser then alerts them that the data could be in­ter­cept­ed by third parties.