How SSL certificates work
Every HTTPS site relies on a certificate issued by a trusted authority. Understanding how certificates, chains and renewal fit together helps you avoid the warnings that drive visitors away.
The chain of trust
Browsers ship with a list of trusted root authorities. A root signs an intermediate certificate, and the intermediate signs your site's certificate. Your server must send its own certificate together with the intermediate, so the browser can follow the chain back to a root it already trusts.
Types of certificates
| Type | What is checked | Typical use |
|---|---|---|
| DV | Control of the domain | Most websites and blogs |
| OV | Domain and organisation | Business sites |
| EV | Domain and detailed company checks | Banks and large shops |
| Wildcard | All subdomains of one level | Many subdomains |
| Multi-domain (SAN) | A list of names | Several sites on one server |
Renewal checklist
- Set up automatic renewal, for example with Certbot.
- Check that the web server reloads after renewal.
- Test the site with an SSL checker after each renewal.
- Keep a reminder 30 days before expiry as a backup.