100% Australian owned and operated
The short version
- HTTPS encrypts the connection between a visitor and your site, and proves the server really is the name in the address bar.
- It works through a certificate, issued for your domain name once you’ve shown you control the domain.
- The certificate lives on your web server, so it comes from your web host, not from where the domain is registered. Most hosts include one.
- The padlock means the connection is private. It doesn’t mean the business behind the site is trustworthy.
What HTTPS does
When an address starts with https://, two things are true that aren’t true for plain http://:
- The connection is encrypted. Anyone between the visitor and the server, on café wifi for instance, sees scrambled data and can’t read or change it.
- The server has proved its name. The browser has checked that it really is talking to
yourname.com.auand not to an impostor.
Both depend on one file on the web server: the certificate.
SSL, TLS, HTTPS: one thing, three names
The technology doing the encrypting is called TLS. Its predecessor was called SSL, and the old name stuck, so everyone still says “SSL certificate”. HTTPS is simply a website loaded over TLS. When a host advertises “SSL”, a setup screen says “TLS” and your browser says “secure”, they’re all talking about the same thing.
How a certificate gets issued
A certificate is a statement, signed by a certificate authority, that a particular key belongs to a particular domain name. Browsers ship with a list of authorities they trust. Before an authority will sign, it wants proof that whoever is asking controls the domain.
The best-known authority is Let’s Encrypt, a not-for-profit whose stated aim is “to make it possible to set up an HTTPS server and have it automatically obtain browser-trusted certificates without any human intervention” (How it works). Its FAQ is blunt about price: “We do not charge a fee for our certificates.” Most web hosts use it, or something like it, behind the scenes.
The two tests in the diagram have names you may see in a control panel (challenge types):
- The file test (HTTP-01). The host places a file at a set address on your site, and the authority fetches it. Your domain’s
Arecord has to be pointing at that host already. - The DNS test (DNS-01). A
TXTrecord is placed at_acme-challenge.yourname.com.au, and the authority looks it up. This is the only test that can produce a wildcard certificate.
Kinds of certificate
| Kind | What was checked | Typical use |
|---|---|---|
| Domain validation (DV) | Control of the domain, and nothing else | Nearly every website |
| Organisation validation (OV) | The domain, plus the organisation’s details | Some larger businesses |
| Extended validation (EV) | The domain, plus a fuller check of the organisation | Banks and similar |
| Wildcard | Covers every subdomain at one level: *.yourname.com.au | Sites with many subdomains |
All of them encrypt the connection equally well. The difference is how much checking went into the name on the certificate. Let’s Encrypt only issues the first kind: it “offers Domain Validation (DV) certificates” and doesn’t offer OV or EV. For an ordinary business website, DV is all you need.
Certificates expire, on purpose
Certificates have short lives. Let’s Encrypt’s “default certificates are valid for 90 days”. Your host renews them automatically, well before they run out, by repeating the test above.
When renewal quietly fails, the certificate expires and every visitor gets a full-page browser warning. The usual causes are DNS changes: the domain was pointed somewhere else, or a record the test relied on was removed. The SSL tab of the toolbox shows any site’s certificate and how many days it has left.
What the padlock doesn’t tell you
The padlock means the connection is private and the server holds a certificate for the name in the address bar. That’s all. A DV certificate says nothing about who is behind the site, and scam sites get certificates just as easily as honest ones.
So the padlock is a reason to check the name in the address bar carefully, not a reason to stop checking. Lookalike domains rely on people seeing a padlock and relaxing.
Where your domain comes into it
The certificate lives on the web server, so it comes from your web host, not from wherever the domain is registered. But three DNS details affect it:
- The domain has to point at the host first. A host can’t pass the file test for a name that still points elsewhere. When you move hosts, expect a short gap before the new certificate arrives.
- Each name needs to be covered.
yourname.com.auandwww.yourname.com.auare separate names. A certificate lists the names it’s good for, and both should be on it. - A CAA record can limit who may issue. If your DNS has a CAA record that doesn’t name the authority your host uses, the request is refused.
HTTPS-only: HSTS, and the endings that enforce it
A site can tell browsers never to use plain http:// with it again. The mechanism is called HSTS, defined in RFC 6797 as a way for “web sites to declare themselves accessible only via secure connections”.
A few endings have this switched on for every name under them. Google’s registry says .dev “is included on the HSTS preload list, making HTTPS required on all connections to .dev websites and pages”, and the same goes for .app. A website on one of those endings won’t load at all without a working certificate, so sort out hosting with HTTPS before you launch.
At Chill Domains. We don’t sell certificates, because you shouldn’t need to buy one: most web hosts include them at no extra charge. If yours doesn’t, that’s worth raising with the host. Our part is the DNS: pointing the domain at your host, and adding a TXT or CAA record if the host asks for one.
Terms in this lesson
- HTTPS
- The secure way of loading a website.
- SSL certificate
- A file on your web server that proves the site is really yours and lets the connection be encrypted, giving you the padlock and
https://. - TLS
- The technology that actually does the encrypting behind HTTPS.
- Certificate authority
- An organisation that browsers trust to issue SSL certificates.
- Domain validation
- The basic check behind most SSL certificates: proof that you control the domain, and nothing more.
- Let’s Encrypt
- A not-for-profit certificate authority that issues SSL certificates at no charge and automatically.
- Wildcard certificate
- An SSL certificate that covers every subdomain at one level, written
*.yourname.com.au. - CAA record
- A DNS record that names the certificate authorities allowed to issue SSL certificates for your domain.
- HSTS
- A rule a website gives browsers: only ever connect to me over HTTPS.
Every term, in full, is in the glossary.
Sources
All read on 2 October 2026.
- How It Works (Let’s Encrypt): the aim of automatic certificates and how control of a domain is proved.
- Frequently Asked Questions (Let’s Encrypt): no fee, domain validation only, and the 90-day lifetime.
- Challenge Types (Let’s Encrypt): the file test, the DNS test and wildcard certificates.
- RFC 6797, HTTP Strict Transport Security (HSTS) (IETF): what HSTS is.
- .dev and .app (Google Registry): both endings require HTTPS for every site.
- RFC 8659, DNS Certification Authority Authorization (CAA) Resource Record (IETF): how a CAA record limits which authorities may issue.