The Small Business Guide to SSL Certificates and HTTPS

A browser warning that says Not Secure is the fastest way to lose a potential customer. They will not read the explanation. They will close the tab. SSL certificates solve this, are completely free, and take ten minutes to set up. Here is everything you need to know.

What SSL Actually Does

SSL (technically TLS, but everyone still says SSL) does two things: it encrypts data between the browser and your server so nobody can read passwords or credit card numbers in transit, and it verifies that your server is actually your server, not an imposter. The green lock icon means both conditions are satisfied.

Without SSL, any device between your customer and your server (public WiFi, a compromised router, a malicious ISP) can read every piece of data sent. Passwords, emails, credit card numbers, everything.

Let's Encrypt: Free SSL Forever

Let's Encrypt is a free, automated certificate authority. It issues SSL certificates valid for 90 days and renews them automatically. There is no cost, no paperwork, and no human approval. Your server proves it controls the domain by solving a challenge, receives a certificate, and installs it automatically.

Let's Encrypt has issued over 300 million certificates. It is the most widely used certificate authority on the internet. Every major browser trusts it.

How to Set It Up

Option 1: Nginx Proxy Manager

If you use Nginx Proxy Manager as your reverse proxy (which VPS1 recommends), SSL is a checkbox. Add your domain in the web UI, check the SSL tab, select Request a new SSL Certificate, and check Force SSL. NPM handles the Let's Encrypt challenge, installs the certificate, and renews it automatically.

Option 2: Caddy

Caddy is a web server and reverse proxy that obtains SSL certificates automatically with zero configuration. Point Caddy at your domain, and it handles SSL by default. No plugins, no configuration files, no cron jobs. It just works.

Option 3: Certbot (Manual)

Certbot is the official Let's Encrypt client. It works with any web server. The command certbot --nginx or certbot --apache handles everything. For more complex setups, certbot supports manual mode, DNS challenges, and wildcard certificates.

Wildcard Certificates

A wildcard certificate covers *.yourdomain.com. One certificate for app.yourdomain.com, mail.yourdomain.com, and crm.yourdomain.com. Let's Encrypt supports wildcard certificates but requires DNS validation (you add a TXT record to prove ownership). Most businesses do not need wildcard certificates. Individual certificates per subdomain work fine and are handled automatically.

Common SSL Mistakes

• Mixed content: Your page loads over HTTPS but includes an image over HTTP. Browsers show a broken lock icon. Fix: use relative URLs or always reference assets with HTTPS.
• Expired certificates: Let's Encrypt certificates last 90 days. If auto-renewal fails, the certificate expires. Set up monitoring to alert you 30 days before expiry.
• Self-signed certificates: These encrypt traffic but do not verify identity. Browsers show a scary warning. Do not use self-signed certificates on public-facing services.

VPS1 sets up SSL on every deployment. It is not optional in our managed stacks.