What is an SSL cer­ti­fic­ate? Defin­i­tion, validity, and costs

An SSL cer­ti­fic­ate is a digital file that confirms a website’s identity and enables an encrypted con­nec­tion between the server and browser. It protects sensitive data like passwords from third-party access. Websites with an SSL cer­ti­fic­ate can be iden­ti­fied by the ‘https’ in the URL and a small padlock icon in the browser.

What is an SSL cer­ti­fic­ate?

Modern SSL cer­ti­fic­ates no longer use the outdated SSL (Secure Sockets Layer) but instead rely on the newer and more secure TLS (Transport Layer Security). In practice, however, ‘SSL cer­ti­fic­ates’ is still the common term when referring to securing a website and server with en­cryp­tion tech­no­logy. The cer­ti­fic­ate itself is a simple data record: the file contains numerous details, such as the issuer’s name, the serial number, and the so-called fin­ger­print for en­cryp­tion. Cer­ti­fic­ates come in various file formats and must be installed on the server for use.

To obtain an SSL cer­ti­fic­ate, website operators must contact a cer­ti­fic­a­tion authority. These or­gan­isa­tions are au­thor­ised to issue an SSL cer­ti­fic­ate but typically charge a fee for their service. But why can’t just anyone set up their own or­gan­isa­tion? The reason for this is that browser man­u­fac­tur­ers, like Microsoft, Mozilla, or Google, must accept the cer­ti­fic­ates; otherwise, the cer­ti­fic­ate would be utterly useless.

How long is an SSL cer­ti­fic­ate valid?

A cer­ti­fic­ate accepted by browsers is not valid in­def­in­itely. Each SSL cer­ti­fic­ate has an ex­pir­a­tion date between 1 and 13 months. By 2029, SSL cer­ti­fic­ates are expected to be valid for a maximum of 47 days. When this occurs, website operators must replace their expired SSL cer­ti­fic­ates and have them renewed; otherwise, the re­spect­ive sites will no longer be marked as par­tic­u­larly secure. Although renewing cer­ti­fic­ates on a regular basis can be both time-consuming and costly, it remains essential. Only by having cer­ti­fic­a­tion au­thor­it­ies re­peatedly verify integrity, identity, and the en­cryp­tion methods in use can user security be reliably ensured.

How does en­cryp­tion work for SSL cer­ti­fic­ates?

There are several methods for en­crypt­ing data transfers. Tra­di­tion­ally, a single key is used for both en­cryp­tion and de­cryp­tion, meaning the exact same key is required to make a message readable again. On the internet, however, this approach is im­prac­tic­al since users often connect with people or or­gan­isa­tions they have never in­ter­ac­ted with outside the web. As a result, there is no secure way to exchange a key without sending it un­en­cryp­ted over a public channel. For this reason, SSL cer­ti­fic­ates rely on a different en­cryp­tion method.

In a Public Key In­fra­struc­ture (PKI), two keys are generated: one public and one private. Messages encrypted with the public key can only be decrypted with the private key. The public key is trans­mit­ted to the browser via the SSL cer­ti­fic­ate and used for en­cryp­tion. Alongside this, the cer­ti­fic­ate also provides the browser with details about the supported en­cryp­tion methods.

A widely used method today is AES (Advanced En­cryp­tion Standard) combined with the SHA256 cryp­to­graph­ic hash function. However, en­cryp­tion standards evolve con­stantly—a method con­sidered secure today may be cracked tomorrow and deemed un­re­li­able.

What SSL cer­ti­fic­ates are there?

There are different types of SSL cer­ti­fic­ates. While issuers may vary in their veri­fic­a­tion processes, these dif­fer­ences are not the main criteria. Instead, SSL cer­ti­fic­ates are primarily dis­tin­guished by the level of applicant veri­fic­a­tion and the scope of coverage. Cer­ti­fic­ates in the Domain Val­id­a­tion category are now often available for free, but the costs of an Extended Val­id­a­tion cer­ti­fic­ate are usually too high for in­di­vidu­als and small busi­nesses.

Domain Val­id­a­tion (DV)

Domain Val­id­a­tion rep­res­ents the most basic level of SSL cer­ti­fic­ates, with veri­fic­a­tion of the website owner being rather minimal. In many cases, the cer­ti­fic­a­tion authority simply sends an email to the address listed in the WHOIS entry. The applicant may then be asked to modify a DNS record or upload a specific file to their server to confirm control over the domain.

Or­gan­iz­a­tion Val­id­a­tion (OV)

OV SSL cer­ti­fic­ates are one level higher in terms of visitor security. The cer­ti­fic­a­tion authority requests documents from the website owners during the val­id­a­tion process—usually after the automated Domain Val­id­a­tion has taken place. The specific documents required depend on the issuing or­gan­isa­tion—often, a business re­gis­tra­tion is requested.

Ad­di­tion­ally, some cer­ti­fic­a­tion au­thor­it­ies contact the website operators via phone. OV SSL cer­ti­fic­ates thus provide more security because there is more thorough vetting of who is truly behind the website. They also offer the advantage of keeping this in­form­a­tion visible to users within the cer­ti­fic­ate itself.

Extended Val­id­a­tion (EV)

SSL cer­ti­fic­ates offered under the ‘Extended Val­id­a­tion’ label represent the highest level of security. This type of cer­ti­fic­ate involves veri­fic­a­tion of the domain and the as­so­ci­ated or­gan­isa­tion, as well as the applicant. It checks whether the applicant is indeed employed by the specified or­gan­isa­tion or company and whether they are au­thor­ised to request such a cer­ti­fic­ate.

Ad­di­tion­ally, the cer­ti­fic­a­tion authority must also be au­thor­ised to conduct Extended Val­id­a­tion. To become au­thor­ised, the authority must pass a review by the CA/Browser Forum, which is a voluntary as­so­ci­ation of cer­ti­fic­a­tion au­thor­it­ies and browser vendors.

What does an SSL cer­ti­fic­ate cost? Free SSL vs paid SSL

A sig­ni­fic­ant factor in cat­egor­ising and selecting an SSL cer­ti­fic­ate is the costs as­so­ci­ated with its ac­quis­i­tion. Relating this aspect directly to the three preceding veri­fic­a­tion types, it can be generally stated that the more extensive the cer­ti­fic­a­tion check, the more one must pay for the cer­ti­fic­ate in the end. Since 2015, Let’s Encrypt has even been a cer­ti­fic­a­tion authority providing cer­ti­fic­ates com­pletely free of charge.

Dif­fer­ences between free and paid cer­ti­fic­ates

For the basic security of a website, ensuring it can be accessed via HTTPS instead of standard HTTP, a free cer­ti­fic­ate is just as effective as a paid one. Both types rely on SSL or TLS protocols, making secure data transfer mandatory between clients and servers.

In some aspects, however, free and paid cer­ti­fic­ates differ sig­ni­fic­antly from each other:

• Val­id­a­tion level: For SSL cer­ti­fic­ate issuance, veri­fic­a­tion of the website owner is usually minimal—Domain Val­id­a­tion is the standard here. Cer­ti­fic­ates with higher security levels always require payment.

• Domain scope: A free SSL cer­ti­fic­ate is typically issued for a single domain without ad­di­tion­al technical effort and remains tied to it. Paid SSL/TLS solutions, however, also support cross-domain cer­ti­fic­ates that can secure multiple websites.

The ad­vant­ages of paid SSL

Paid SSL cer­ti­fic­ates provide several ad­vant­ages over free al­tern­at­ives, as already outlined in the previous section. Depending on the provider and package, they can cover multiple domains with minimal effort. This not only improves flex­ib­il­ity but also reduces the overall ad­min­is­trat­ive workload. In case of issues, providers or cer­ti­fic­a­tion au­thor­it­ies typically include per­son­al­ised support—a service that free SSL cer­ti­fic­ate users usually don’t receive.

Which cost model is the right one?

A paid SSL cer­ti­fic­ate with EV veri­fic­a­tion is without doubt the optimal en­cryp­tion solution for a web project. However, this type of cer­ti­fic­a­tion is usually only af­ford­able for larger companies, which are also the main target group in this case. More af­ford­able cer­ti­fic­ates are generally suf­fi­cient for web projects in the SME sector, as long as no highly sensitive data—such as in online banking—is trans­mit­ted. For smaller projects where the transfer of personal data plays little or no role, free SSL cer­ti­fic­ates are a good al­tern­at­ive to paid options. In any case, when choosing your SSL cer­ti­fic­ate, you should pay attention to the following points:

• Scope: Check how far the SSL cer­ti­fic­ate extends—for example, whether sub­do­mains are also covered.
• Single name: A standard cer­ti­fic­ate only applies to a single domain. This means that www.example.com and all subpages of this website are covered, but not sub­do­mains.
• Wildcard: These cer­ti­fic­ates use a wildcard (place­hold­er). Instead of only covering www.example.com, they also apply to all sub­do­mains.
• Multi-domain: Multi-domain cer­ti­fic­ates (also called SAN cer­ti­fic­ates) go far beyond the coverage of single-name or wildcard cer­ti­fic­ates. Many cer­ti­fic­a­tion au­thor­it­ies offer cer­ti­fic­ates that can cover up to 100 domains.

How can you recognise an SSL cer­ti­fic­ate?

If you are using a modern browser, it’s easy to check whether a website is secured with SSL/TLS: just look at the address bar! Two in­dic­at­ors show that en­cryp­tion is active:

• a lock icon
• the address starts with https:// instead of the usual http://

The ad­di­tion­al ‘S’ stands for Secure and signals to users that an ad­di­tion­al SSL/TLS layer has been added to the Hypertext Transfer Protocol. In the TCP/IP protocol stack, an extra en­cryp­tion layer has been inserted—between TCP and HTTP.

The lock icon is primarily an obvious signal from your browser that the website you’re visiting has a valid cer­ti­fic­ate. What many users don’t realise is that it’s also a button that leads to ad­di­tion­al security in­form­a­tion about the website. Clicking it opens a pop-up window with details about the cer­ti­fic­ate issuer, the en­cryp­tion method used, and the cer­ti­fic­ate’s validity period.

If the website you are visiting does not have a valid SSL cer­ti­fic­ate, you will see neither a lock icon nor https:// in the address bar. In addition, some browsers display warnings if users attempt to submit passwords or other sensitive data on such websites. The browser then alerts them that the data could be in­ter­cep­ted by third parties.