SSL Certificates Explained: Types, Validation, and Why Every Site Needs One
From DV to EV, free to paid, single-domain to wildcard -- understand every aspect of SSL/TLS certificates and learn how to verify yours is properly configured.
Check your SSL certificate nowWhat Is SSL/TLS and Why Does It Matter?
If you have ever noticed the padlock icon next to a website's address in your browser, you have seen an SSL certificate in action. That icon represents an encrypted connection between your browser and the web server -- and in today's internet, it is no longer optional.
SSL (Secure Sockets Layer) is the original protocol for encrypted web communication. TLS (Transport Layer Security) is its modern successor, with TLS 1.2 and TLS 1.3 being the current standards. Although the underlying protocol is technically TLS, the term "SSL certificate" persists in common usage.
An SSL/TLS certificate is a digital document issued by a Certificate Authority (CA) -- a trusted third party that verifies the server's identity. It serves two purposes: authentication (proving the server is who it claims to be) and encryption (protecting data from interception). If you are new to how domains work, our beginner's guide to domain names covers the fundamentals.
Google has treated HTTPS as a ranking signal since 2014, and modern browsers display "Not Secure" warnings for pages served over plain HTTP. An SSL certificate is a baseline requirement for credibility, security, and search visibility.
How HTTPS Works: The TLS Handshake
When you visit a website over HTTPS, your browser and the server perform a TLS handshake to establish a secure connection. Here is what happens in milliseconds:
- Connection request -- Your browser connects to the server and requests a secure connection, sending supported cipher suites and TLS versions.
- Certificate presentation -- The server responds with its SSL/TLS certificate, containing its public key, domain name, issuing CA, and validity period.
- Certificate verification -- Your browser checks the certificate against trusted CA root certificates, verifying it has not expired, matches the domain, and has not been revoked.
- Key exchange -- Browser and server use asymmetric cryptography to negotiate a shared session key securely.
- Encrypted session -- All subsequent data is encrypted using fast symmetric encryption with the shared key.
If the certificate is expired, self-signed, or issued for a different domain, the browser displays a security warning and may block the connection entirely.
Types of SSL Certificates by Validation Level
SSL certificates differ in how thoroughly the Certificate Authority verifies the applicant. There are three validation levels:
Domain Validation (DV) certificates are the most common type. The CA verifies that you control the domain, typically through a DNS record or email challenge. Issuance takes minutes. DV certificates are suitable for the vast majority of websites, blogs, and small businesses.
Organization Validation (OV) certificates verify the organization's identity in addition to domain control. The CA checks the business name, location, and legal status. Issuance takes one to three days. OV certificates are recommended for business websites and e-commerce stores.
Extended Validation (EV) certificates require the most rigorous verification: legal entity, physical address, operational status, and requester authority. EV certificates were historically shown with a green address bar, though most modern browsers have removed this indicator. They are used by financial institutions and large enterprises.
For most website owners, a DV certificate provides the same encryption strength as OV or EV. The difference is purely in identity verification, not in the security of the encrypted connection.
SANs, Wildcards, and Multi-Domain Certificates
Beyond validation level, SSL certificates also differ in how many domains they cover:
Subject Alternative Names (SANs) allow a single certificate to cover multiple specific domain names. For example, one certificate might list example.com, www.example.com, and app.example.com as SANs. Most certificates include at least the bare domain and the www subdomain as SANs by default. The Domainwise SSL checker displays all SANs listed on a certificate so you can verify exactly which domains are covered.
Wildcard certificates cover all subdomains at a single level using an asterisk. A certificate for *.example.com covers www.example.com, api.example.com, and any other subdomain. However, it does not cover deeper levels like sub.www.example.com or the bare domain itself (which must be listed as a separate SAN).
Multi-domain (UCC) certificates combine SANs to cover entirely different domains under one certificate, such as example.com, example.net, and anotherbrand.com. These are popular in enterprise environments.
Free vs Paid SSL Certificates
The rise of free SSL certificates has made HTTPS accessible to every website regardless of budget.
Let's Encrypt is the most widely used free certificate authority, providing automated DV certificates trusted by all major browsers. Certificates have a 90-day validity period with automatic renewal. The shorter validity is actually a security advantage, limiting exposure if a private key is compromised.
Cloudflare offers free SSL through its CDN and proxy service. Route your domain through Cloudflare and it automatically provisions and manages an SSL certificate -- one of the easiest ways to add HTTPS to any website.
Paid certificates from commercial CAs like DigiCert or Sectigo make sense when you need OV or EV validation, longer validity periods, or a financial warranty. However, the encryption is identical -- a free DV certificate provides the exact same security as a paid one.
Check Your Certificate with Domainwise
The Domainwise SSL/TLS Checker lets you verify any domain's certificate configuration in seconds. Enter a domain name and the tool returns a comprehensive overview: the certificate issuer, subject, validity dates, days remaining until expiry, all Subject Alternative Names, the TLS protocol version, and the certificate chain.
Common issues to watch for include expired certificates, certificates issued for the wrong domain, missing SANs for subdomains, and certificates expiring within 30 days. Regular checks are especially important after hosting migrations, DNS changes, or certificate renewals.
The tool is completely free, requires no sign-up, and is available in 12 languages. For a comprehensive domain security review, also check your WHOIS privacy protection to ensure your registration data is not publicly exposed. Together, a valid SSL certificate and WHOIS privacy form the foundation of responsible domain security.