Blog
3 min read

What Is an SSL Certificate? (And Do You Need to Pay for One?)

An SSL certificate (really a TLS certificate) proves your website is who it says it is and lets browsers encrypt the connection — it's what puts the padlock and https:// in front of your site. What's inside one, how browsers check it, free vs paid certificates, expiry, and the errors you'll see when it goes wrong.

An SSL certificate is a small digital file on your web server that does two jobs:

  1. Proves identity. It shows the browser that this server really is allowed to serve yourapp.com.
  2. Enables encryption. It lets the browser and server set up an encrypted connection, so nobody in between can read or alter the traffic.

It's what makes your site load over https:// with a padlock instead of a "Not secure" warning.

A naming note: "SSL" is the old name. The protocol in use today is TLS, so these are technically TLS certificates. Everyone still says SSL.

What's inside a certificate

  • The domain name(s) it covers — yourapp.com, maybe www.yourapp.com, or *.yourapp.com for a wildcard.
  • A public key, used to set up the encrypted connection.
  • Who issued it — the Certificate Authority (CA).
  • Valid from / valid until dates.
  • The CA's digital signature, which proves the certificate wasn't forged.

The matching private key stays secret on your server. If it leaks, someone could impersonate your site.

How the browser checks it

When someone visits your site, the browser:

  1. Receives your certificate.
  2. Checks the domain on it matches the address bar.
  3. Checks it hasn't expired.
  4. Checks it was signed by a CA the browser trusts (browsers ship with a list).
  5. Uses it to agree on encryption keys for the session.

All of this happens in milliseconds during the TLS handshake.

Free vs paid certificates

For almost every app, free is the right answer. Let's Encrypt issues free certificates that every browser trusts, and most hosts request and renew them automatically. (How Automatic SSL Works)

Paid certificates mostly add:

  • Organisation Validation (OV) / Extended Validation (EV): the CA checks your company exists. Browsers no longer show this prominently, so the visible benefit is small.
  • Warranties and support, which some enterprises require.

The encryption is identical. A free certificate is not "less secure".

Expiry — and why it keeps getting shorter

Certificates expire on purpose; short lifetimes limit the damage if a key leaks. Let's Encrypt certificates have lasted 90 days, and it has announced a move to 64-day certificates by default from February 2027, heading to 45 days in 2028. That's only a problem if renewal isn't automatic — so make sure it is. (Certbot and Let's Encrypt)

Errors you'll see when something's wrong

Error Usual cause
NET::ERR_CERT_DATE_INVALID Certificate expired (renewal failed)
NET::ERR_CERT_COMMON_NAME_INVALID Certificate doesn't cover this exact domain (often www vs no www)
NET::ERR_CERT_AUTHORITY_INVALID Self-signed certificate or missing intermediate certificate
ERR_SSL_PROTOCOL_ERROR Server misconfigured, or HTTPS on a port speaking plain HTTP

(Your Connection Is Not Private · ERR_SSL_PROTOCOL_ERROR)

The summary

  • An SSL/TLS certificate proves your site's identity and enables HTTPS encryption.
  • Free certificates from Let's Encrypt are just as secure as paid ones.
  • Lifetimes are getting shorter, so renewal must be automatic.

EasySpawn issues and renews certificates for your custom domains automatically, so HTTPS just works and never quietly expires. See how it works or join the waitlist.

Related: What Is HTTPS? · What Is HSTS? · Mixed Content Errors · Connect a Custom Domain to Your App

Keep reading