An SSL certificate is a file on your web server that does two jobs: it encrypts the connection between your site and your visitor, and it proves your site is who it says it is.
That is the short answer. The part most guides have not caught up with is that the maximum lifetime of a certificate has been cut, and it is being cut again twice more before 2029. If your renewal process is a calendar reminder once a year, it is about to stop working.
SSL, TLS, and why the name is wrong
The protocol in use today is TLS. SSL was its predecessor and has been deprecated for years. Everyone still says “SSL certificate” because the name stuck, including the companies selling them.
They are the same product in practice. If a vendor markets a “TLS/SSL certificate”, that is the same thing.
What it actually does
Encryption. Data between the browser and your server is scrambled, so anyone intercepting it on the network sees nothing useful. This is why forms, logins and payment pages need it.
Authentication. The certificate is issued by a Certificate Authority that has verified you control the domain. This is what stops someone running a copy of your site on a different server and presenting it as yours.
Integrity. Content cannot be modified in transit without detection.
Browsers now treat its absence as a failure state rather than a missing bonus. A site without a valid certificate shows a “Not secure” warning, and on pages with form fields that warning becomes prominent.
What changed in 2026
This is the part to pay attention to.
In April 2025 the CA/Browser Forum passed ballot SC-081v3, reducing the maximum validity of publicly trusted TLS certificates in three steps:
|
From |
Maximum certificate lifetime |
|
Previously |
398 days |
|
15 March 2026 |
200 days |
|
15 March 2027 |
100 days |
|
15 March 2029 |
47 days |
The 200-day limit is already in force. Any certificate issued now cannot be valid for longer than that.
The same ballot also shortens how long domain control validation can be reused, from 398 days down to 10 days by 2029. In practice that means you will not just be reissuing more often, you will be re-proving domain ownership more often too.
What this means practically. A once-a-year renewal reminder stops being sufficient. By 2029 a 47-day certificate means roughly eight renewals a year, which no one is going to do by hand reliably. Automation stops being a convenience and becomes the only workable approach.
If your certificate is managed by your host and renews automatically, you are already fine. If someone on your team renews it manually each year, that process needs replacing before it starts failing.
The types, and which you need
|
Type |
Validates |
Issue time |
Typical use |
|
Domain Validation (DV) |
You control the domain |
Minutes |
Most business sites, blogs, brochure sites |
|
Organisation Validation (OV) |
Domain plus the organisation exists |
Days |
Corporate sites where the entity matters |
|
Extended Validation (EV) |
Domain plus deeper legal vetting |
Over a week |
Rare now, mainly financial institutions |
Here is the honest part: for most Singapore businesses, DV is enough. Browsers removed the green address bar that used to distinguish EV certificates, so visitors cannot tell the difference. The encryption is identical across all three. You are paying for the vetting, not for stronger security.
By coverage, there are three more distinctions:
- Single domain, covering one hostname
- Wildcard, covering a domain and all its direct subdomains
- Multi-domain (SAN), covering several unrelated domains on one certificate
A wildcard is the usual choice if you run shop., blog. and app. subdomains.
Free versus paid
Let’s Encrypt issues free DV certificates and they are trusted by every major browser. The encryption is identical to a paid DV certificate.
What you get by paying:
- Support when something breaks
- A warranty, which matters less than vendors imply
- OV and EV options, if you need them
- Sometimes longer validity, though that advantage is disappearing with the new limits
When free is right: most business websites, where the host supports automatic renewal.
When paid is worth it: when you need OV or EV for a regulated or enterprise context, or when you want a vendor to call. Also when your hosting does not support automated issuance, though the better fix there is different hosting.
Installing and verifying
Most Singapore hosting providers now issue and renew certificates automatically. Check your hosting panel before buying anything, because you may already have one included. Our guide on choosing the right web hosting covers what to look for.
After installation, four checks:
- Force HTTPS. Redirect all http:// traffic to https:// at the server. Do not rely on a plugin.
- Check for mixed content. One image or script loaded over http on an https page will trigger a browser warning. Search your templates for hardcoded http:// URLs.
- Verify the chain. A certificate missing its intermediate certificates works in some browsers and fails in others, which is a confusing bug to diagnose. An SSL checker will tell you.
- Confirm auto-renewal is on, and that the alert email goes to someone who still works there.
That last one causes more outages than any technical fault. Certificates expire on a schedule, and the notification goes to whoever set it up years ago.
Does SSL help SEO?
Slightly, and indirectly.
HTTPS has been a lightweight Google ranking signal since 2014. It is minor on its own and will not move you up by itself.
The real impact is elsewhere. A browser warning on your checkout destroys conversion far faster than any ranking change. Referrer data is lost when traffic moves from an HTTPS site to an HTTP one, which distorts your analytics. And some browser features only work on secure origins.
Treat it as a requirement rather than an optimisation. For the things that do move rankings, see technical SEO explained.
Frequently asked questions
What is an SSL certificate?
A file installed on your web server that encrypts traffic between your site and visitors, and proves your site’s identity through a Certificate Authority that verified you control the domain. The current protocol is TLS; “SSL” is the older name that stuck.
How long does an SSL certificate last?
Since 15 March 2026 the maximum is 200 days. This drops to 100 days on 15 March 2027 and 47 days on 15 March 2029, under CA/Browser Forum ballot SC-081v3. The previous maximum was 398 days, which is what most older guides still state.
Do I need to pay for an SSL certificate?
Usually not. Let’s Encrypt issues free domain-validated certificates trusted by all major browsers, with encryption identical to paid equivalents. Pay when you need organisation or extended validation, or when you want vendor support.
What is the difference between DV, OV and EV certificates?
DV verifies you control the domain and issues in minutes. OV also verifies the organisation exists and takes days. EV adds deeper legal vetting. The encryption is identical across all three. Since browsers removed the green address bar, visitors cannot distinguish them, so DV is sufficient for most business sites.
Does SSL help SEO?
HTTPS has been a minor Google ranking signal since 2014, but the effect is small. The larger impacts are practical: browser warnings damage conversion, referrer data is lost without HTTPS, and some browser features require a secure origin.
What happens if my certificate expires?
Browsers block the page with a full-screen security warning that most visitors will not click through. The site is effectively offline. This is why automated renewal matters, particularly as maximum lifetimes shorten.
What is a wildcard SSL certificate?
A certificate covering a domain and all its direct subdomains, so one certificate secures shop., blog. and app. on the same domain. Useful when you run several subdomains; unnecessary for a single site.
Why do I still see “Not secure” after installing a certificate?
Almost always mixed content: an image, script or stylesheet loaded over http on an otherwise secure page. Search your templates and database for hardcoded http:// URLs. It can also be a missing intermediate certificate in the chain.
Getting this handled
For most businesses the right outcome is that you never think about certificates again: the host issues them, renews them automatically, and HTTPS is enforced at the server.
If your current setup involves anyone manually renewing anything, that is worth fixing now rather than in 2029 when it means eight renewals a year. We cover it as part of domain and hosting and website maintenance. For the wider picture, see website security best practices for Singapore SMEs and what web hosting is.
