SSL Certificate Complete Guide

📅 February 13, 2025⏱️ 10 min read🔒 Security

What is SSL/TLS?
How it works
Certificate types
How to check a certificate
Common errors
Let's Encrypt
Best practices

What is SSL/TLS?

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are cryptographic protocols that secure communication over the internet. When you visit an HTTPS site, TLS encrypts the connection between your browser and the server, preventing eavesdropping and tampering.

Encryption — protects sensitive data in transit
Authentication — confirms the server's identity
Integrity — ensures data hasn't been modified
SEO — Google uses HTTPS as a ranking signal
Trust — browsers show a padlock icon for HTTPS sites

How it works

The TLS handshake establishes a secure connection in these steps:

Client hello — browser sends supported TLS versions and cipher suites
Server hello — server selects a version/cipher and sends its certificate
Certificate verification — browser validates the cert (issuer, expiry, domain match)
Key exchange — both sides derive a shared session key
Encrypted communication — all subsequent traffic is encrypted

Certificate chain

Root CA
  └─ Intermediate CA
      └─ End-entity certificate (your site)

Browsers trust a built-in list of root CAs. They validate your cert by walking up the chain to a trusted root.

Certificate types

By validation level

DV — Domain Validation

Verifies domain ownership only. Issued in minutes. Free via Let's Encrypt. Suitable for most websites.

OV — Organization Validation

Verifies domain ownership plus organization identity. Takes 1–3 business days. Suitable for business sites.

EV — Extended Validation

Strictest verification — legal entity checks, phone verification. Takes 1–2 weeks. Used by banks and large e-commerce. Note: since 2019, major browsers no longer display the green organization name bar.

By coverage

Single domain — covers one domain, e.g. www.example.com
Wildcard — covers all subdomains, e.g. *.example.com
Multi-domain (SAN) — covers multiple different domains in one cert

How to check a certificate

Browser

Click the padlock icon in the address bar → view certificate details: issued to, issuer, expiry date.

Command line

# View certificate info
openssl s_client -connect example.com:443 -servername example.com

# Check expiry date
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -dates

Online tools

SSL Labs — comprehensive SSL configuration test
301check.com — shows TLS info for every hop in a redirect chain
crt.sh — certificate transparency log search

Common errors

Certificate expired — NET::ERR_CERT_DATE_INVALID

Renew the certificate. Use Certbot's auto-renewal to prevent this.

Domain mismatch — NET::ERR_CERT_COMMON_NAME_INVALID

The cert doesn't cover the domain being accessed. Get a cert for the correct domain, or use a wildcard cert.

Incomplete chain — NET::ERR_CERT_AUTHORITY_INVALID

The intermediate certificate is missing from the server config.

# Nginx — use fullchain.pem, not just cert.pem
ssl_certificate /path/to/fullchain.pem;
ssl_certificate_key /path/to/privkey.pem;

Mixed content

An HTTPS page loading HTTP resources (images, scripts, stylesheets). Update all resource URLs to HTTPS or use protocol-relative URLs (//example.com/image.jpg).

Let's Encrypt

Let's Encrypt is a free, automated, open CA run by the non-profit ISRG. It has made HTTPS accessible to everyone.

Certbot (recommended)

# Install on Ubuntu/Debian
sudo apt install certbot python3-certbot-nginx

# Issue and auto-configure Nginx
sudo certbot --nginx -d example.com -d www.example.com

# Test auto-renewal
sudo certbot renew --dry-run

# Cron for auto-renewal
0 0,12 * * * certbot renew --quiet

acme.sh (lightweight alternative)

curl https://get.acme.sh | sh
acme.sh --issue -d example.com -d www.example.com --nginx

Best practices

# Nginx — strong TLS config
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;

# Enable HSTS
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

# OCSP Stapling
ssl_stapling on;
ssl_stapling_verify on;

Set up certificate expiry alerts (30 days before)
Use CAA DNS records to restrict which CAs can issue for your domain
Monitor certificate transparency logs for unauthorized issuance
Test your config with SSL Labs