SSL Certificates

What an SSL certificate actually does

An SSL certificate does two jobs at once, and it is worth separating them, because only one of the two is about encryption.

The first job is encryption. Without a certificate, everything sent between a visitor's browser and your server travels as readable text. Anyone positioned between the two — on shared office Wi-Fi, on a public hotspot, at an internet provider — can read it. That includes anything typed into a form: contact details, passwords, card numbers. With a certificate installed, that traffic is scrambled so that only your server can unscramble it.

The second job is identity. The certificate is issued to your domain by a certificate authority that checks you control it. That is what lets the browser show a padlock rather than a warning, and it is why a certificate cannot simply be generated by anyone claiming to be you.

Why sites without one are now penalised

SSL used to be something only online shops bothered with. That changed on two fronts, and both now affect sites that take no payments at all.

Browsers stopped being subtle. Chrome, Firefox, Edge and Safari all label plain-HTTP pages as “Not secure” in the address bar. On any page with a form, that warning appears exactly where a visitor is deciding whether to trust you with their details.

Search engines take it into account. Google confirmed HTTPS as a ranking signal in 2014. It is a light one, and it will not lift a weak page above a strong one — but between two otherwise comparable sites, the encrypted one has an edge, and the unencrypted one is carrying an avoidable handicap.

There is also a practical reason that has nothing to do with rankings: several browser features now refuse to run over plain HTTP at all, and modern payment and login integrations increasingly require HTTPS as a precondition.

What is included

The certificate supplied here is a RapidSSL certificate powered by GeoTrust, which covers what the large majority of business sites need:

• 256-bit encryption — the same standard of protection used for online banking traffic.
• A $10,000 USD warranty — cover provided by the issuing authority against a failure on their side.
• A static site seal you can place on your pages, so visitors can see the site is secured without having to inspect the address bar.
• Issuance within five hours of purchase, rather than the days that manually validated certificates can take.
• Browser and device compatibility across current desktop and mobile browsers.

Before you order

Two things are worth knowing in advance, because both can hold up an order that is otherwise ready to go.

A dedicated IP address is required. The certificate is bound to an IP as well as a domain, so a dedicated IP has to be in place before the certificate is purchased. If your plan does not currently include one, add it first. The higher shared hosting tiers include a dedicated IP; the plan comparison shows which.

You will need to generate a CSR. The Certificate Signing Request is produced inside your control panel and identifies the domain the certificate is for. The three ordering steps above walk through where to find it. Get the domain name exactly right at that stage — a certificate issued for the wrong hostname has to be reissued.

Common questions

Not sure which you need?

If you are unsure whether your current plan already includes a dedicated IP, or which of your domains needs securing first, get in touch and we will check the account and tell you what is actually required — including if the answer is that you do not need anything further.