What Is an SSL Certificate? What Your Website Actually Needs
Choose a TLS certificate by hostname coverage, identity requirements, hosting support, and renewal responsibility instead of a confusing product label.
- https
- tls
- certificates
- security
An SSL certificate is the common product name for a certificate used in a TLS-protected connection. The client checks the service identity against the requested hostname. For a website, first check whether the hosting platform manages certificates, then identify the exact hostnames and any organization-identity requirement. The TLS identity standard describes certificate-based service verification.
Certificate selection combines separate questions. DV, OV, and EV describe validation. Exact-name, wildcard, and multiple-name coverage describe which names a certificate can match. A certificate can combine a validation level with a coverage choice.
A managed host may already provide the required workflow
Before buying a separate certificate, open the host's documentation for custom-domain HTTPS. Confirm whether the host issues and renews certificates, which names the workflow supports, and whether the platform permits installing an externally purchased certificate.
GitHub Pages provides a concrete example: correctly configured custom-domain sites support HTTPS and HTTPS enforcement. GitHub documents that workflow. The example shows why the hosting platform should be the first stop, rather than proof that every host supports identical options.
For a self-managed deployment, identify the certificate client, validation method, server configuration, and renewal owner. Use the HTTPS guide for the connection model. This guide addresses the certificate decision rather than every server-specific installation command.
Validation levels describe identity checks rather than cipher strength
DigiCert's current documentation defines domain validation as confirming that the requester controls the requested domain names. The issuer does not verify organization identity for that DV certificate. The DV documentation states those limits.
Organization validation adds verification of the organization's legal existence. Extended validation adds further checks, including operational status and approval by a verified representative. The OV documentation describes organization validation. The EV documentation describes the additional validation.
| Validation choice | Question for the site owner |
|---|---|
| DV | Does the requirement concern an authenticated connection to the requested names? |
| OV | Does a documented requirement call for verified organization identity? |
| EV | Does a documented requirement specifically call for extended validation? |
The questions are selection advice. Confirm a customer's or organization's actual requirement before purchasing a certificate. Do not infer a legal or contractual requirement merely from the site accepting payments.
TLS negotiates cipher suites through a separate handshake mechanism. The validation label does not itself select the negotiated symmetric cipher. RFC 8446 defines the cipher-suite offer.
Let's Encrypt offers DV certificates and does not offer OV or EV. The issuer's FAQ explains its service scope. An explicit organization-validation requirement therefore changes the issuer shortlist.
Hostname coverage needs an exact inventory
List every name visitors use, including names that redirect to another hostname. The following hypothetical inventory uses reserved example domains.
| Certificate name or names | Matching result in the example |
|---|---|
www.example.com | Matches the exact listed hostname |
*.example.com | Can match shop.example.com |
*.example.com alone | Does not match the apex example.com |
*.example.com alone | Does not match a.shop.example.com |
example.com, www.example.com, shop.example.net | Lists several requested names separately |
RFC 9525 limits a certificate wildcard to one label in the reference name. The wildcard rules also require the permitted wildcard in the leftmost label. The identity standard defines those limits.
Multiple-name coverage uses the Subject Alternative Name mechanism. Let's Encrypt confirms that one certificate can contain several names through SAN. The FAQ describes multiple-name certificates.
A wildcard DNS record does not add a name to a certificate. DNS wildcard matching and certificate wildcard matching follow different rules. RFC 9525 explicitly distinguishes the two. The wildcard section states the distinction. See the wildcard DNS guide for the DNS configuration task.
Issuance and renewal require a working validation path
A certificate authority must validate the requested domain names through its supported procedure. Let's Encrypt documents HTTP-01 and DNS-01 challenges. HTTP-01 retrieves a challenge file through port 80. DNS-01 checks a TXT record and supports wildcard issuance. The challenge documentation explains both paths.
Choose a procedure that the deployment can maintain. For example, a DNS validation workflow needs appropriate DNS access when validation runs. As operational advice, scope automation credentials to the required DNS operation and keep an accountable renewal owner.
Do not consider issuance complete merely because the certificate client reports success. Verify the certificate visitors actually receive at the intended hostname. With curl available, a basic diagnostic request is:
curl --head --verbose https://www.example.com/
Replace the example hostname. curl verifies the certificate signature and requested server name by default. The verification guidance describes that check. Keep verification enabled during the test.
The deployment also needs the corresponding private key for certificate authentication. TLS's CertificateVerify message proves possession of that key. RFC 8446 defines that proof. As security advice, restrict private-key access and avoid distributing one key across unrelated deployments for convenience.
A connection certificate does not certify an honest business
Chromium explains that a secure connection indicator does not establish website trustworthiness. A phishing site can also use HTTPS. The browser team's explanation states that boundary.
Use organization validation when a real identity requirement calls for organization validation. Continue to review the site's accounts, application permissions, data handling, and domain administration. A certificate cannot replace those operating decisions.
Before ordering, finish a short request record: exact hostnames, hosting platform, required validation level, selected issuer, validation method, installation owner, and renewal owner. If the platform already handles the required coverage, follow that workflow first. If another requirement remains, buy the certificate that satisfies the documented requirement and verify the deployed result.
Sources and further reading
The TLS identity standard defines the matching task
IETF RFC 9525, section 1.1. Fetched 2026-10-30.
GitHub documents managed HTTPS for custom domains
GitHub Docs, About HTTPS and GitHub Pages. Fetched 2026-10-30.
DigiCert defines domain validation
DigiCert CertCentral, Domain Validation. Fetched 2026-10-30.
DigiCert defines organization validation
DigiCert CertCentral, Organization Validation. Fetched 2026-10-30.
DigiCert defines extended validation
DigiCert CertCentral, Extended Validation. Fetched 2026-10-30.
The TLS standard defines cipher negotiation
IETF RFC 8446, section 4.1.2. Fetched 2026-10-30.
Lets Encrypt describes validation and name coverage
Let's Encrypt FAQ, validation and multiple-name questions. Fetched 2026-10-30.
The IETF reserves example domains
IETF RFC 2606, section 3. Fetched 2026-10-30.
The TLS identity standard limits wildcard matching
IETF RFC 9525, section 6.3. Fetched 2026-10-30.
Lets Encrypt documents domain control challenges
Let's Encrypt, Challenge Types. Fetched 2026-10-30.
curl documents certificate and hostname verification
curl, SSL certificate verification. Fetched 2026-10-30.
The TLS standard explains private key possession
IETF RFC 8446, section 4.4.3. Fetched 2026-10-30.
Chromium separates connection security from website safety
Chromium Blog, An Update on the Lock Icon. Fetched 2026-10-30.
About the author(s)
Fenwei Bian is a software developer in her thirties who spends her working hours in pull requests and her weekends with her hands in soil or sawdust. Years of open source on GitHub taught her that names are interfaces: a good one is clear, honest about what it does, and kind to whoever has to use it next.
She gardens because it rewards patience and punishes wishful thinking, and she does woodwork because a joint either fits or it doesn't. Both habits show up in how she writes about naming — measure twice, check the source, and don't sand over a rough spot and hope no one notices.
For Namefi she writes about how domain markets actually move, the practical trade-offs of tokenizing and flipping names, and picking a domain you'll still be glad you own in twenty years.