SSL certificate purpose explained - FAQ

What Does an SSL Certificate Do?

Quick Answer

Choose or manage the certificate based on the hostnames you need to protect, the validation level, the server platform and whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain and verify the live HTTPS connection before relying on the certificate.

Before You Begin

Identify every hostname the certificate must cover.
Confirm that you control DNS or the required validation channel.
Generate and securely retain the private key when a CSR is required.

Key Details

What is an SSL certificate and what is it used for?

Introduction SSL certificates are used to create an encrypted channel between the client and the server. Transmission of such data as credit card details, account login information, any other sensitive information should be encrypted to prevent eavesdropping. With an SSL certificate, data is encrypted prior to being transmitted via Internet. Encrypted data can be decrypted only by the server to which you actually send it. This ensures that the information you submit to websites will not be stolen.

Starting from 06/08/2014, Google announced that having an SSL certificate installed on your website would increase your ranking position, which is another great reason to use an SSL. The certificate itself represents base64 encoded data that contains information about the entity the certificate was issued for, public key required for encryption and digital signature verification, and digital signature created with the private key of the certificate issuer. An SSL certificate should be installed on the server side.

When you access a website secured by an SSL certificate issued by a trusted Certification Authority, you will see https:// at the beginning of its URL. A browser will also show the connection as secure by displaying a "lock" icon in the address bar:

Types of SSL certificates SSL certificates can be divided into 3 validation groups: Domain Validation Certificates Requires a certificate applicant to prove his/her control over the domain name only. The issued certificate contains a domain name that was supplied to the Certification Authority within the certificate request. Organization Validation Certificates Requires a certificate applicant to prove that his/her company is a registered and legally accountable business, and to pass domain validation. The issued certificate contains a domain and company name of the certificate applicant.

Extended Validation Certificates Includes validation requirements of two validation types mentioned above and additional requirements. The issued certificate contains a domain and company name of the certificate applicant.

How to Verify

Open the HTTPS site from a clean browser session and inspect the certificate subject, SAN hostnames, issuer, validity dates and chain. Test every hostname covered by the certificate and confirm that HTTP redirects behave as intended.

Troubleshooting

DNS validation records are missing, incorrect or added at the wrong DNS provider.
The certificate does not include the hostname being opened.
The private key does not match the certificate or CSR.
The server is missing an intermediate certificate or is still presenting the old certificate.

Frequently Asked Questions

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key and the certificate remains valid. Reissue it when the key, CSR or certificate details must change.

Why does the browser still show the old certificate?

The server or load balancer may still present the old certificate, another virtual host may be selected, or an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Submit a ticket when validation remains pending after the published records are visible, or when the NiceNIC order does not provide the expected certificate files.

Related NiceNIC Guides

If the issue continues after you complete the checks above, submit a NiceNIC support ticket with the affected domain or product, the exact error message, the time of the issue and the troubleshooting already completed.