An SSL certificate encrypts the connection between your visitors and your website (HTTPS), and without one browsers label your site "Not secure". This guide explains what a certificate is, how DV, OV and EV differ, how to move a site to HTTPS properly, and why certificate lifetimes keep getting shorter from 2026 onwards.
What an SSL certificate actually does
The correct name today is TLS, but nearly everyone still says "SSL". A certificate does two jobs:
- It encrypts the data between browser and server: passwords, contact forms, order details. Nobody else on the same Wi-Fi network can read or change it.
- It confirms the identity of the domain. A certificate authority (CA) has checked that whoever requested the certificate really controls the domain.
When everything is in order, the address starts with https:// and the browser shows no warning.
DV, OV or EV: which one you need
| Type | What is checked | Time to issue | Good for |
|---|---|---|---|
| DV (Domain Validation) | Control of the domain only | Minutes | Blogs, brochure sites, most small shops |
| OV (Organization Validation) | The domain and that the company exists | A few days | Companies that want their name in the certificate |
| EV (Extended Validation) | Thorough company vetting | Days to weeks | Banks, institutions, contractual requirements |
The encryption is equally strong for all three. The only difference is how thoroughly the owner was vetted. Modern browsers no longer show the company name in the address bar for EV, so ordinary visitors won't notice the difference. For the vast majority of sites, a DV certificate is enough. Which certificates are available to you, and whether one is included, depends on your plan, so check what yours includes or write to us.
Why browsers show warnings
- No HTTPS at all: Chrome labels HTTP pages "Not secure". Google has announced that from Chrome 154 (scheduled for October 2026), "Always Use Secure Connections" will be on by default. Chrome will try HTTPS first and ask before opening a public site that only works over HTTP (Google's announcement).
- Expired certificate: the most common problem. Visitors see a full-page error, and many simply leave.
- Wrong name: the certificate covers
yourcompany.ro, but the site opens onwww.yourcompany.roor another subdomain it doesn't include. - Mixed content: the page loads over HTTPS but pulls images, scripts or fonts over
http://. The browser blocks those resources or drops the padlock.
How long a certificate lasts (changes 2026–2029)
In April 2025 the CA/Browser Forum, where certificate authorities and browser makers agree the rules, adopted ballot SC-081. It gradually cuts the maximum lifetime of public certificates:
| Certificates issued from | Maximum validity |
|---|---|
| before 15 March 2026 | 398 days |
| 15 March 2026 (in force now) | 200 days |
| 15 March 2027 | 100 days |
| 15 March 2029 | 47 days |
Let's Encrypt, the most widely used free issuer, already issues 90-day certificates. It has announced a gradual move to 45 days by 2028 (details). The practical takeaway: renewing by hand is no longer realistic. Use automatic renewal in your hosting panel (for example AutoSSL in cPanel) or an ACME client. If you bought a commercial certificate, check whether the provider reissues it automatically.
Moving a site to HTTPS, step by step
- Back up your files and database. That backup is your responsibility.
- Install the certificate from your hosting control panel for both
yourcompany.roandwww.yourcompany.ro. Openhttps://yourcompany.roand check the padlock. - Update the site address in your application. In WordPress, go to Settings → General and change "WordPress Address" and "Site Address" to
https://. If the fields are greyed out, they are set inwp-config.php(WP_HOME,WP_SITEURL). - Replace old links in your content. With WP-CLI, run
wp search-replace 'http://yourcompany.ro' 'https://yourcompany.ro', with--dry-runfirst. A search-and-replace plugin also works. - Add a 301 redirect from HTTP to HTTPS. Some panels have a "Force HTTPS" switch. On Apache, in
.htaccess:RewriteEngine OnRewriteCond %{HTTPS} offRewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] - Fix mixed content. Open the browser console (F12 → Console) and look for "Mixed Content" warnings. Fix any theme or plugin that hard-codes
http://addresses. - Tell the search engines. Add the
https://property in Google Search Console and update your sitemap address. - Only once everything works, consider enabling HSTS. Be careful: once it's on, browsers will refuse HTTP for your domain for the whole period you set.
If you run Cloudflare or another proxy in front of your site, use the "Full (strict)" SSL mode. That avoids redirect loops and an unencrypted hop between the proxy and the server.
Checklist
- A valid certificate for the domain and for
www. - Automatic renewal switched on. Check the expiry date every few months anyway.
- A 301 redirect from HTTP to HTTPS, with no loops.
- WordPress and content URLs updated to
https://. - No "Mixed Content" warnings in the console.
- The HTTPS site added to Google Search Console.
Want to know which SSL certificate options come with our web hosting or WordPress hosting plans? Write to us at [email protected].
