What Is an SSL Certificate and How to Tell If a Site Has One

October 17, 2026 • NOFYI Editorial Team

You have probably seen the small padlock in your browser address bar. You may also have been told to look for HTTPS before entering a password or payment detail. Both clues relate to an SSL certificate, also called a TLS certificate. The name SSL is still used in everyday language, even though the modern protocol is TLS. The certificate itself is a small digital document that helps a browser confirm it is talking to the intended site and that the connection can be encrypted.

This guide explains what an SSL certificate is, what it does and does not prove, how to check for one in a browser, and what to do when a browser warns you about it. It includes a worked example, honest limitations, and answers to common questions. No technical background is needed.

What Is an SSL Certificate?

An SSL certificate binds a domain name to a cryptographic key and to identity information that a trusted certificate authority, or CA, has verified. When your browser visits a site over HTTPS, the site presents its certificate. Your browser checks the certificate chain, the domain name, and the expiry date, and then uses the keys to agree on encryption for the session.

In plain terms, the certificate does two jobs. First, it helps confirm that the site you reached

How to Tell If a Site Has an SSL Certificate

You do not need special tools for a basic check. Use the clues your browser already shows.

Look at the address bar. The address should start with https:// rather than http://. In many browsers, a padlock icon appears next to the address.
Click the padlock or the site information icon. Your browser should say the connection is secure and show the certificate details.
Check the certificate itself. Look for the domain name it was issued for, the organisation that issued it, and the dates it is valid from and to.
Look for warnings. If the browser says the connection is not private, the certificate has expired, or the name does not match, do not enter personal information on that page.
Check the whole page, not just the address. A secure page should not show mixed cont

Worked Example: Checking a Real Site Step by Step

Imagine you want to check a familiar site, such as your bank or a large online store, before you log in. You would not need to install anything. You would follow the browser clues.

First, type the address yourself or use a bookmark you trust. Do not click a link in an unexpected email or message. Look at the address bar. It should show https:// and the exact domain you expect, for example www.example-bank.com, with no extra words, misspellings, or strange subdomains. A padlock should appear beside the address.

Next, click the padlock. The panel should say the connection is secure. Open the certificate details. Check that the certificate is issued for the same domain you visited. Check the issuer name. Check that the current date falls within the valid from and valid to dates. If the certificate was issued for a different domain, or it expired last month, the browser should warn you. Do not ignore that warning.

Then, consider the context. Does the page look li

When a certificate expires, browsers stop trusting the site, even if nothing else has changed. Visitors see a warning page, and many leave. For site owners, this is why automatic renewal matters. Services that issue certificates automatically, and hosting panels that renew them in the background, reduce the chance that a site goes dark because someone forgot a date.

If you own a site, set a calendar reminder a few weeks before expiry, even if renewal is automatic. Check that the renewal actually happened. If you use a content delivery network or load balancer, confirm that the certificate on the public edge is the one that was renewed, not an old copy on a different server. Expiry is one of the most common and most preventable causes of a sudden Not Secure warning.

If you visit a site and see an expiry warning, do not click through and enter personal details. The site owner may have simply forgotten to renew, but you cannot tell that from the warning alone. Wait, use a different official channel to check, or contact the

Limitations

SSL certificates are important, but they have clear limits.
- A certificate does not prove that a site owner is honest. Phishing sites can obtain valid certificates for lookalike domains.
- Encryption protects data in transit. It does not control what the site does with the data after it arrives.
- A padlock does not mean a download is safe, a product is genuine, or a review is real.
- Certificates can be misissued, revoked, or left to expire. Browsers check revocation in different ways, and not every failure is visible to visitors.
- Mixed content can weaken an otherwise secure page. A secure page that loads insecure scripts may still expose part of the session.
- A valid certificate for one subdomain does not automatically cover another subdomain, unless the certificate is a wildcard or lists it.
Use the padlock as a first check, then add the other checks: exact domain, source of the link, reason for the request, and the site reputation.

Frequently Asked Questions

Does a padlock mean a site is safe?

No. A padlock means the connection is encrypted and the certificate matches the domain. It does not mean the site owner is trustworthy. A phishing site can show a padlock. Check the exact domain and how you reached the page.

What is the difference between SSL and TLS?

SSL is the older name. TLS is the modern protocol that replaced it. People still say SSL certificate for convenience, but current sites use TLS. The practical point is the same: HTTPS should use a current, valid certificate.

Why does a site say Not Secure?

Common reasons are a missing certificate, an expired certificate, a certificate for a different domain, or a page loaded over plain HTTP. If you own the site, check the certificate and redirect HTTP to HTTPS. If you are a visitor, do not enter personal details on a Not Secure page.

Do I need an SSL certificate for a simple blog?

Yes, in practice. Browsers warn about HTTP pages, search engines prefer HTTPS, and even a simple contact form benefits from encryption. Many hosts and certificate providers offer free automatic certificates, so cost is rarely the barrier it once was.

Conclusion

An SSL certificate helps a browser confirm the domain it reached and encrypt the connection. You can check for one by looking for https, a padlock, and a valid certificate for the exact domain. Expiry is a common reason for warnings, and automatic renewal helps site owners avoid it.

The most important lesson is that SSL encrypts in transit, it does not prove trust. Phishing sites can have SSL, and a padlock does not make a dishonest site honest. Combine the certificate check with a careful domain check and a pause before you enter personal information. That combination is far stronger than any single icon.

That is why you should check more than the padlock. Check the exact domain spelling, check how you arrived at the page, check whether the request makes sense, and check the site reputation through independent means. A padlock is necessary for safe form submission, but it is not sufficient proof that a site is honest.

Another common misunderstanding is that HTTPS means a site cannot track you. Encryption protects the contents of your traffic from outsiders on the path. The site itself can still see what you send it, and it can still set cookies, record your account activity, and share data according to its privacy policy. Encryption is about transport, not about the site behaviour after the data arrives.

What to Do When You See a Certificate Warning

Browser warnings are deliberately hard to ignore. Treat them as a stop sign, not a minor annoyance.
- Do not enter a password, payment detail, or one-time code on a page with a certificate warning.
- Check the date and time on your device. A wrong system clock is a common cause of false expiry warnings.
- Check the address carefully. A misspelling may mean you landed on a different site.
- Try the site from another device or network. If the warning appears everywhere, the site certificate is likely the problem.
- Contact the site owner through a known channel if the site is one you trust and the problem persists.
Do not install a certificate offered by an unfamiliar site to bypass a warning. Do not follow instructions in a pop-up to change security settings. If the warning appears on a public Wi-Fi login page, that is a separate case: captive portals often interrupt HTTPS until you sign in. Even then, complete only the portal login, then close the browser and reconnect to the real site before entering sensitive details.

site owner through a known address. An expired certificate means the browser cannot confirm the connection in the usual way.

SSL Encrypts in Transit, It Does Not Prove Trust

Encryption protects data while it travels. It prevents someone on the same Wi-Fi network or an intermediate network from easily reading your password or card number as it passes by. It does not guarantee that the site receiving that data is honest, competent, or careful with it after it arrives.

A phishing site can have a valid SSL certificate. Anyone who controls a domain can usually obtain a DV certificate for that domain, because DV checks control of the domain, not the character of the owner. A scammer can register a lookalike domain, obtain a certificate for it, and build a page that looks like a bank login. The browser will show a padlock because the connection is encrypted. The padlock says the connection is encrypted to that domain. It does not say the domain owner is trustworthy.

ke the real site you know? Are the logo, layout, and wording consistent? Does the site ask for information it would not normally ask for, such as your full card PIN or a password sent by email? A valid certificate does not answer those questions. It only confirms the encrypted connection and the domain named on the certificate.

Finally, if anything feels off, close the tab and reach the site through a bookmark or by typing the address again. If you arrived through a link, compare the address character by character. Many phishing pages use a lookalike domain that is one letter different from the real one. The certificate may still be valid for that lookalike domain, which is why the address check matters as much as the padlock.

Certificate Expiry: Why Sites Break on a Schedule

Certificates expire. This is by design. A short lifetime limits the damage if a key is compromised and forces site owners to renew regularly. Many certificates today last about 90 days when issued automatically, while others last a year or more, depending on the provider and policy.

ent warnings about insecure images or scripts, although many browsers now handle this quietly.

Different browsers show these details in slightly different places, but the pattern is the same: https, a padlock, and a valid certificate for the exact domain you visited. If any of those pieces is missing, treat the page as unencrypted or untrusted until you have confirmed what is wrong.

Types of Certificates in Plain Language

Not all certificates involve the same level of identity checking. The encryption can be similar, but the verification behind the certificate differs.

Domain Validated, or DV, certificates confirm that the applicant controls the domain. They are common, fast to issue, and used by many small sites, blogs, and personal projects. They prove control of the domain at the time of issue, not that the organisation behind the site is legitimate.

Organisation Validated, or OV, certificates add checks on the organisation that requested the certificate. Extended Validation, or EV, certificates involve more thorough checks. Modern browsers no longer show large green company names for EV certificates in the same way they once did, so visitors should not rely on a company name in the address bar as proof of trust.

For most visitors, the type matters less than the overall picture. A DV certificate on a reputable site is normal. An OV or EV certificate does not automatically make an unfamiliar site safe. The certificate is one signal, not a verdict on the site owner honesty.

is the site named on the certificate, rather than an impostor that intercepted your connection. Second, it makes it possible to encrypt the data that travels between your browser and the site, so that others on the same network cannot easily read it.

HTTPS is the visible result. The S stands for Secure, and it means the connection uses TLS encryption. HTTP without the S means the connection is not encrypted in the same way. A site can still be untrustworthy over HTTPS, as we will explain, but HTTPS is the minimum you should expect when a site asks for personal information.