SSL Certificates for Business Websites

What an SSL certificate is

An SSL certificate is a small file installed on the server your website runs on. It lets a browser open an encrypted connection, so nothing sent between the two can be read or altered on the way, and it confirms the server answering for your domain is the one it was issued to.

With it in place the address changes from http to https and the browser shows a padlock instead of a warning.

A naming point that confuses people: the technology in use today is called TLS. Everybody, including the companies selling them, still says SSL.

The distinction that matters most

A certificate protects the connection. It does not protect the site. Those are two different problems, and they get sold as one often enough to be worth saying plainly.

Think of a sealed envelope rather than a locked filing cabinet. Whatever a visitor types into your contact form travels where nobody in the middle can read it. That says nothing about whether the cabinet at the other end is locked. A site running an out of date plugin can be defaced or loaded with malware while showing a valid padlock. It works the other way too: criminals get certificates, so a phishing page shows the same padlock as your bank.

Protecting the site itself means updates, malware scanning and backups you have actually tested. Read about website security for that half of the job. Neither substitutes for the other.

What the browser warning means to a visitor

Every current browser marks a site without a certificate. What a visitor sees depends on what they are doing:

• A "not secure" label beside your address, on every page, permanently.
• A sharper warning the moment they click into a form field, because they are about to type into an unencrypted page.
• With an expired or mismatched certificate, a full page warning they have to deliberately click through before they reach you at all.

Almost nobody reads those literally. A business owner reads "not secure" as a technical detail. A customer reads it as a judgement about the business, before they have seen your work or your phone number.

SSL certificates for business websites: who needs one, and who does not need more

In practice, every site with a public address needs a certificate. That includes the case people argue about most: a brochure site with no shop, no logins and a single contact form.

• Any site with a form. A name, phone number and message sent over an unencrypted connection travel as readable text.
• Any site taking payments or holding logins. Not optional, and payment providers will refuse to work without HTTPS.
• Any site you want found. Search engines treat HTTPS as the default state of a normal website.
• Any site with embedded content. Maps, booking widgets, fonts and video players increasingly refuse to load onto an unencrypted page.

What almost nobody needs is more than the basic option. Paying more does not make the encryption stronger: the cheapest certificate available protects a connection exactly as well as the most expensive. The extra buys a third party checking who you are, or coverage for more names. You need more only if you run several subdomains or separate domains, or a contract names a validation level.

The validation levels, and what they prove

Certificates differ in two ways: how much checking happens before one is issued, and how many names it covers. Those are separate decisions, and mixing them up is how people buy the wrong thing.

There are three levels of checking. Domain validated (DV) proves you control the domain and is what almost every small business site uses. Organisation validated (OV) adds checks that your organisation legally exists. Extended validation (EV) is the strictest of all. Browsers used to reward EV with a green bar showing the company name, then stopped because people did not notice it, which removed most of the argument for it.

Read that table across, not down. The encryption is identical on every row. What changes is who has checked what, and how many names are covered.

A wildcard covers one level down. A certificate for *.yourbusiness.com secures shop.yourbusiness.com but not shop.uk.yourbusiness.com. That catches people out.

Get Your SSL Certificate Not sure which one? Ask us

Moving from another provider

Certificates do not transfer the way domains do. There is no unlock step and no authorisation code. You issue a new one and install it in place of the old, which keeps working right up to the swap, so there is no gap.

Three things are worth checking first:

• Where the site is actually hosted. The certificate is installed there, which is not always the company you pay for the domain. If that is fuzzy, the guide to domain names versus web hosting sorts it out.
• Whether your current provider already issues one. Some providers issue and renew a certificate for you. Check what the host you are on actually does before you buy anything.
• What the current certificate covers. If it covers the www version and the replacement does not, you find that out through a warning on a live site.

Buying makes sense when the host includes nothing, when you need organisation validation or a wildcard, or when you want the certificate, the hosting, the domain and the renewal date in one place with one number to call.

Renewal, and what an expiry looks like

A certificate is issued for a fixed term and browsers stop trusting it the moment that term ends. There is no grace period.

Visitors get the full page warning, the one that takes a deliberate click to bypass. Most do not bypass it, they leave. Everything else pointed at the site fails at the same moment: forms stop submitting, booking tools stop loading.

Automatic renewal and a contact address somebody still reads prevent nearly all of it. One more trap when renewal is manual: renewing issues a new file, and that file does nothing until it is installed. People renew, assume they are covered, and get the warning anyway.

Mixed content, the problem that appears after you switch

Mixed content is the usual surprise after a site moves to HTTPS. The page loads securely, but something on it, an image, a stylesheet, a script, is still requested over the old unencrypted address. The browser either strips the padlock from that page or blocks the item outright.

The symptoms are recognisable: a padlock on the homepage but not on an interior page, a slider that stops working, a logo that disappears. Clearing it is methodical rather than difficult:

• Update hardcoded http addresses in your templates and in your page content. In a content managed site they hide inside the stored content, not the design.
• Redirect http to https once, cleanly, rather than through a chain of hops.
• Update the canonical tags, the sitemap, your analytics property and anywhere else the old http address is written down.
• Recheck every page type, not just the homepage. Blog posts and landing pages are where the stragglers live.

Mistakes that cost people money

• Forgetting the renewal. The cheapest problem to prevent and the most visible when it happens. Turn on automatic renewal.
• Covering the apex but not www. yourbusiness.com loads fine and www.yourbusiness.com throws a warning, or the reverse. Test both, then redirect one to the other so there is a single live address.
• Assuming the padlock means the site is safe. It means the connection is private. A compromised site keeps its padlock, and so does a phishing page.
• Buying extended validation for the reassurance. Browsers no longer display the company name prominently, so the money buys a check almost no visitor will see.
• Installing the certificate and stopping there. Without forcing HTTPS both versions stay live, which splits your search signals and leaves some visitors on the unencrypted copy.
• Buying a wildcard for a site with no subdomains. Pay for coverage you use, not coverage that sounds thorough.

How AldoMedia helps

AldoMedia, LLC has been building and maintaining websites for Western New York businesses since 1999, and is an independent authorised reseller for the certificates sold here. We do the unglamorous part: decide what needs covering, issue the certificate, install it on the right server, force HTTPS, hunt down the mixed content and put the renewal somewhere it cannot be forgotten.

It also means telling you when not to buy. If your hosting already issues a certificate that renews itself, that is the answer, and it costs nothing to hear it.

If your site is showing a warning and you are not sure why, describe what you are seeing or call 716-771-2536 and we will tell you which of the usual causes it is.