SSL Certificates Explained: Why Every Site Needs The Padlock
The padlock in the browser bar is not decoration. It means the connection between your visitor and the site is encrypted - passwords, forms, and cookies are harder to snoop on the wire, and browsers treat the site as a normal modern destination instead of a warning screen. Here is what SSL actually is, who issues it, and where your domain registrar fits in.
What SSL (And TLS) Means In Plain English
SSL is the old name people still use. The modern protocol is TLS. In conversation, "SSL certificate" still means the credential that lets a site serve HTTPS.
When a site uses HTTPS:
- Traffic is encrypted in transit
- The browser can check that the certificate matches the domain
- Users see https:// and usually a padlock instead of "Not secure"
When a site is plain HTTP, browsers label it not secure. Forms on HTTP are a gift to anyone on the same network who wants to intercept data. Search engines also prefer HTTPS. There is no good reason for a live public site to stay on HTTP in 2026.
What The Certificate Actually Proves
A basic domain-validated certificate proves control of the domain name at issuance time. It does not prove your company is trustworthy, well-run, or good at its trade. It proves the connection is encrypted to that hostname.
Extended Validation and organisation-validated certificates exist for higher identity checks. Most small business sites are fine with standard domain validation - the free tier used by Let's Encrypt and many hosts.
Registrar vs Host vs CDN - Who Does What?
This confuses people because three different companies might touch the setup:
Domain registrar - sells and manages the domain name, DNS, and often related tools. Some registrars include help with SSL or certificates as part of the package. At Dab Hand Domains an SSL certificate is included with every domain at no extra cost - part of the same "basics included" list as WHOIS privacy, DNS, email forwarding, and renewal reminders.
Web host - where website files live. Most decent hosts issue and renew Let's Encrypt certificates automatically when your domain points at them.
CDN / reverse proxy (Cloudflare and similar) - can terminate SSL at the edge so visitors get HTTPS even if origin setup is fiddly. Custom hostnames and SaaS-style SSL appear in more advanced setups.
In practice for a normal brochure site: point DNS at the host, tick "use free SSL" or let auto-SSL run, wait a few minutes, force HTTPS redirects. The domain still has to be yours and resolving correctly - that is the registrar/DNS side.
Why Free SSL Is Normal Now
Paid certificates used to be a yearly tax. Certificate authorities and hosts industrialised free domain validation. For the vast majority of sites, free SSL is correct. You pay for certificates when you need special types (wildcard management at scale, EV branding, certain enterprise compliance) - not because HTTPS itself should be an upsell.
If a host still charges extra just to turn on a basic padlock, treat that as a red flag for the whole package.
What Breaks When SSL Is Wrong
Common failure modes:
- Certificate expired - browsers show a full-page warning
- Certificate for the wrong name (www vs non-www, or a staging hostname)
- Mixed content - page is HTTPS but loads scripts or images over HTTP, so the padlock breaks or soft-warns
- DNS pointed at a server that never completed validation
Fix names in the certificate to match what users type. Redirect www to apex or the reverse so one canonical host holds the cert cleanly. Renewals should be automatic - if you are manually uploading .pem files every 90 days for a basic site, something in the stack is outdated.
HTTPS And SEO / Trust
Google has treated HTTPS as a ranking signal for years. More importantly, users have been trained to distrust "Not secure." Local service businesses collecting phone numbers and quote forms cannot afford that label. Email clients and payment flows also expect modern TLS.
SSL is not a marketing badge you buy for authority. It is table stakes so the site can function without scaring people off.
What You Should Do On A New Domain
- Register the domain and point it at your host or site builder
- Enable the host's free SSL (or confirm the registrar/CDN path if that is how your stack works)
- Visit both https://yourdomain and https://www.yourdomain - fix whichever fails
- Turn on automatic HTTP → HTTPS redirect
- Check the contact form still submits on HTTPS
- Do not ignore expiry emails if your stack ever sends them - though auto-renew of certs should make those rare
WHOIS privacy, DNS control, and SSL sit together as day-one hygiene. None of them should require a sales call.
Registrar "SSL Included" - How To Read That
When a registrar says SSL is included, it usually means they help you get a certificate or secure hostname as part of using their platform - not that encryption replaces hosting. You still need somewhere for the website to live (or a forwarding target). Think of included SSL as "we do not charge a separate security tax for the basic padlock path," consistent with free privacy and free forwarding.
Dab Hand's public line is exactly that: free WHOIS privacy, full DNS management, email forwarding, SSL certificate, and auto-renewal reminders - all included, no extras for the basics.
Bottom Line
Every live site needs HTTPS. Free certificates are normal. Browsers punish plain HTTP. Your job is to point the domain correctly, let a modern host or CDN issue the cert, and keep www/apex consistent.
If someone tries to sell you expensive SSL as the main "security package" for a simple brochure site, buy the padlock the normal free way and spend the money on backups, 2FA on your registrar account, and not losing the domain at renewal.