SSL (https)

Are SSL, TLS and https the same thing?

They’re used to mean almost the same thing. SSL is the name of the older technology, and what’s actually used today is its successor, TLS, but people keep using the familiar name SSL.

https is the web address scheme (http) with this encryption added. Once you add an “SSL certificate” to your website, its address opens with https.

A certificate is both an encryption key and a stamp confirming “this is the real owner of this address.” Your customer’s browser checks the certificate to confirm the address is genuine, then sets up an encrypted connection.

So when a provider says “SSL applied,” “TLS configured” or “switched to https,” you can assume they mostly mean the same job. What you should check isn’t the technical name, but whether your site opens with https and no warnings when customers visit.

What’s the difference between free and paid SSL certificates?

The level of encryption is the same whether free or paid. The difference is “how much gets verified” when the certificate is issued. A free certificate automatically checks only that you own the address, while an expensive one checks with documents that your company actually exists.

In the past, a certificate with company verification could show your company name in big green letters in the address bar, but major browsers have since dropped almost all such special indicators. That’s why a free certificate is enough for most local businesses and ordinary online stores.

Let’s Encrypt is the best-known issuer of free certificates. Many hosting companies and deployment platforms add and renew free certificates like these automatically.

A paid certificate is mainly worth considering when a business partner or tender document requires a specific certificate. Without such a requirement, making sure auto-renewal reliably works matters far more to your customers’ experience than an expensive certificate.

How long does an SSL certificate last, and why does it expire?

A certificate is valid for anywhere from a few months to under 1 year, and validity periods are getting shorter. They’re made short on purpose to limit the damage window if a key ever leaks.

For example, Let’s Encrypt currently issues 90-day certificates and has announced plans to cut that in two steps: to 64 days from February 2027 and 45 days from February 2028. That’s too frequent for anyone to renew by hand every time, so auto-renewal is practically a must.

So checking “whether it renews automatically” matters more than “whether you bought a certificate.” If auto-renewal stops for any reason, customers see a warning the day after it expires.

Hosting providers or deployment platforms usually handle auto-renewal, but it can quietly stop after you change your domain connection settings or switch providers. After any big change, check once that the certificate’s expiry date has been pushed out, just for peace of mind.

Does SSL protect my website from hacking?

No. SSL only protects “the path” between your customers and your website. It stops the name and phone number a customer types into your contact form from being snooped on or altered in transit, but it doesn’t protect your website’s server or admin account itself.

So even an https website can be hacked if the admin password leaks or weaknesses in outdated software are left unpatched. Server and admin panel security need separate care through updates, password management and backups.

For customers, too, “https” doesn’t automatically mean “trustworthy.” Fake sites can get free certificates as well, so it’s important to check that the address is exactly right. If you always use the same main address when texting payment or booking links, your customers won’t get confused.

How do I switch my website from http to https?

Adding the certificate isn’t the end of it. You also need to smoothly redirect customers and search engines arriving at the old http address over to https. If you skip this cleanup, the same page can show up under two addresses or warnings can get mixed in.

Done properly, you can keep most of your existing search visibility. Google says that when the same content opens on both http and https, it usually picks the https address as the main one, so as long as every 301 redirect is in place, search results will naturally move over to your https address.

1. 01Ask your hosting provider or web agency to issue the certificate and set up auto-renewal.
2. 02Check that both your main address and the www address open with https.
3. 03Set up automatic redirection from http to https (a 301 redirect).
4. 04Change the addresses of photos, videos and links inside your pages to https too. If even one stays on http, you get a “mixed content” warning.
5. 05Check that the site address registered in Google Search Console and Naver Search Advisor uses https.
6. 06Update the QR code on your business cards, your ads and your social media profile links to the https address.

Why does my site show a “Not secure” warning?

It usually appears when the certificate has expired, when the address on the certificate doesn’t match the actual address, or when the page mixes in files loaded over http. A similar warning can also show up if the date and time on the customer’s device are wrong.

Each browser shows this differently, too. Chrome, for example, may show a different icon instead of a padlock even for secure addresses, so a missing padlock doesn’t automatically mean there’s a problem. The sure check is whether the address starts with https and there’s no warning message.

If you spot a warning, take a screenshot showing which address, which device and what message appeared, and send it to your provider. If it’s urgent, like an expired certificate, customers may be unable to book or contact you, so let them know right away.

• Does the certificate cover both the www address and the main address?
• Is auto-renewal on, and who gets notified if it fails?
• Are any photos or files on the page loaded over http?