HTTPS and your security certificate, explained properly

The short version

What HTTPS actually does

When someone types a message into your contact form or their card details into your checkout, that information travels across dozens of networks between their device and your server — their Wi-Fi, their broadband provider, several internet backbones, your hosting company. Over plain HTTP, every one of those hops can read it, like a postcard. HTTPS puts it in a sealed envelope: it is encrypted on their device and only decrypted on your server.

The second job is identity. Encryption alone would be pointless if the "envelope" could be opened by an impostor pretending to be you. So HTTPS also proves your server is really yourbusiness.co.uk and not a copy set up on a dodgy café Wi-Fi. That proof is the certificate.

What a certificate is, in plain terms

A certificate is a small digital document that says "this public key belongs to yourbusiness.co.uk", signed by a certificate authority (CA) that browsers trust — Let's Encrypt, DigiCert, Sectigo and a handful of others. Think of it as a passport: the CA is the passport office, and the browser is border control checking the passport is genuine, in date, and matches the person in front of it.

Certificates have a fixed lifetime — usually 90 days for free Let's Encrypt certificates, up to a year for paid ones — and must be renewed. Most expiry problems are simply renewals that silently failed.

The ways it goes wrong

• Expired certificate (critical). The passport is out of date. Every visitor gets a red "Your connection is not private" page. Chrome makes it deliberately hard to click past. Sales stop, enquiries stop, and your email may start bouncing if it shares the certificate.
• Expiring soon (high). We warn you 14 days out, because the usual reason a certificate expires is that nobody noticed the renewal had stopped working.
• Name mismatch (high). The certificate is valid but for a different name — often issued for yourbusiness.co.uk but not www.yourbusiness.co.uk, or vice versa. Visitors using the uncovered version get the warning.
• Self-signed (high). A certificate you (or your host) created yourself rather than one from a trusted authority. Technically encrypts, but no browser trusts it, so it behaves like having none.
• No HTTPS at all (high). Port 443 does not answer. Modern browsers now label plain-HTTP sites "Not secure" in the address bar on every page.
• Weak signatures and old protocols (medium). Certificates signed with SHA-1, or servers still accepting TLS 1.0/1.1, use encryption that has known breaks. Modern browsers refuse some of these outright.

How to check

VigilScan connects to your site exactly as a browser would, reads the certificate, and checks its expiry, the names it covers, who issued it and how it is signed. Our report shows you the dates and the names so you can see precisely what is wrong.

In your own browser, click the padlock (or the "Not secure" label) in the address bar, then "Connection is secure" → "Certificate" to see the same details.

How to fix it

On cPanel / Spaceship hosting: certificates are usually free and automatic via AutoSSL or Let's Encrypt. Go to cPanel → SSL/TLS Status (or your host's SSL section). Make sure your domain *and* its www version are both covered and show as valid. If one says "activation failed" or "not issued", the most common causes are: the domain's DNS not pointing at this server yet, Cloudflare proxying interfering with validation (temporarily set the record to "DNS only", issue the certificate, then re-enable the proxy), or a redirect or rewrite rule on the site blocking the /.well-known/acme-challenge/ path the authority uses to verify you.

On Cloudflare: Cloudflare gives you a certificate at its edge automatically. Set SSL mode to Full (strict) so the connection between Cloudflare and your server is also properly encrypted — "Flexible" mode leaves that leg in plain text.

Renewals: if a certificate expired, renew it immediately, then find out *why* the automatic renewal failed so it does not happen again in 90 days. Most hosts show the renewal status and error next to the certificate.

Old protocols: ask your host to disable TLS 1.0 and 1.1 (most already have). On a server you manage, set ssl_protocols TLSv1.2 TLSv1.3; in nginx or SSLProtocol -all +TLSv1.2 +TLSv1.3 in Apache.

Common questions