The short answer
An SSL (TLS) certificate lets visitors’ browsers talk to your site over an encrypted https connection and confirms the connection really ends at your domain. On Goji hosting a free Let’s Encrypt certificate is issued and renewed automatically for each domain, so your job is usually just to make the site use https everywhere.
What an SSL certificate does
Technically the protocol is TLS, but everyone still says SSL. A certificate does two things: it lets the browser and your server encrypt the conversation so passwords and form data cannot be read in transit, and it proves the connection is to your domain, not an impostor. Browsers show a padlock for a valid certificate and warn visitors when one is missing or broken. Search engines also prefer https sites.
What a free certificate is, and is not
A free Let's Encrypt SSL certificate is issued and renewed automatically for each domain on the account.
Let’s Encrypt certificates are domain validated: they prove the holder controls the domain. They do not prove anything about the business behind it, and for ordinary websites that is all a visitor needs. Certificates are short lived and renewed automatically, which is why “set and forget” works only when the automatic renewal can still reach your site.
Why issuing sometimes fails
- The domain does not point at the server yet. The certificate authority has to reach your site over the domain to check it. If the nameservers or A record still point elsewhere, issuing waits. See nameservers vs DNS records.
- A recent DNS change has not spread. Give it time; propagation can take up to 48 hours.
- The site blocks the check with an overzealous security rule or a redirect that loops.
After the certificate exists: make the site use it
- Redirect http to https so every visitor lands on the secure address. Do it once, with a permanent (301) redirect.
- Update the site’s own address. In WordPress this is the Site Address in Settings; on other systems, the base URL in configuration.
- Fix “mixed content”. If a secure page loads an image, script or stylesheet over plain http, the browser flags it. Search the page source for
http://links to your own domain and change them to https. - Update links you control such as your social profiles, email signature and any ad or analytics settings.
When the padlock disappears
If visitors suddenly see a warning, check in order: has the domain’s DNS changed, did the certificate renew (the control panel shows its status), and is the warning on one page only (a mixed-content problem) or on all of them (a certificate problem)?
Common questions
Do I need to buy an SSL certificate?
Not on Goji hosting: a free Let’s Encrypt certificate is included for every domain on the account.
Is a free certificate less secure than a paid one?
The encryption is the same. A paid certificate may add business-identity validation and a warranty, which most ordinary sites do not need.