SSL/TLS certificate

What it means

An SSL/TLS certificate is an electronic document confirming a domain’s identity and enabling an encrypted connection between browser and server. It is what puts https in the address bar and keeps form data off the wire in clear text.

A certification authority issues it for a limited period. It attests control over the domain, not the trustworthiness of the company behind it - a common misunderstanding.

A certificate protects only the path data takes between browser and server. It does not encrypt the database, the backups or the content of emails, and it does nothing against someone who gets onto the server itself - that is the job of other measures. So do not confuse it with end-to-end encryption, where not even the service operator can read the message.

How it works in practice

It is now standard even for a simple company site: browsers mark pages without it as insecure and search engines take it into account, so it touches SEO too. For an online store taking payments it is non-negotiable.

Issue and renewal are automatic at most hosting providers. On your own server you also set up the http to https redirect and check the DNS records so the certificate covers every subdomain in use.

Certificates, domains and hosting are recurring services, often invoiced by a foreign provider without VAT. A VAT payer self-assesses the tax on such a service as the recipient, so in our clients’ books we do not leave these small invoices until year end; we check them straight away and include them in self-assessment for the right period.

What to watch out for

An expired certificate shows visitors a warning that looks like an attack, and most people close the page. Automatic renewal and a monitored notification address cost less than one day in that state.

A valid certificate does not yet mean the whole page is secure. If an https page loads images, scripts or a form over http, the browser reports mixed content and blocks part of the page. It happens most often with a hastily launched campaign on a new landing page: the form stops sending enquiries and nobody notices for a while.