SSL certificates: a complete guide to HTTPS in 2026

HTTPS has long been the web standard. In 2026, browsers mark HTTP sites as insecure, and Google considers HTTPS a ranking factor. Let's cover everything about SSL certificates, from theory to practical configuration.

SSL/TLS basics

What are SSL and TLS

SSL (Secure Sockets Layer) is an obsolete encryption protocol. The last version of SSL 3.0 was deemed insecure in 2015.

TLS (Transport Layer Security) is the modern protocol that replaced SSL. The current versions are:

TLS 1.2 — the minimum acceptable version
TLS 1.3 — the recommended version (faster and more secure)

The term “SSL certificate” is used by tradition, but technically this is a TLS certificate.

How HTTPS works

CodeMarkdown

1. Клиент → Сервер: "Привет, поддерживаю TLS 1.3, шифры: X, Y, Z"
2. Сервер → Клиент: "Выбрал TLS 1.3, шифр X. Вот мой сертификат"
3. Клиент проверяет:
   - Сертификат выдан доверенным CA
   - Домен совпадает
   - Срок действия не истёк
4. Клиент и сервер генерируют сессионный ключ
5. Дальнейшее общение зашифровано

Types of SSL certificates

By validation level

1. DV (Domain Validation)

Validation: domain ownership
Issuance time: minutes
Price: free (Let's Encrypt) — $50/year
Suitable for: blogs, personal websites, small projects

2. OV (Organization Validation)

Validation: domain ownership + organization existence
Issuance time: 1-3 days
Price: $50-200/year
Suitable for: business websites, corporate portals

3. EV (Extended Validation)

Validation: full legal entity verification
Issuance time: 1-2 weeks
Price: $200-500/year
Suitable for: banks, payment systems, large e-commerce sites

By number of domains

Single Domain

CodeText

Защищает: example.com
Не защищает: www.example.com, blog.example.com

Wildcard

CodeText

Защищает: *.example.com
Примеры: www.example.com, blog.example.com, api.example.com
Не защищает: example.com (нужен отдельный или SAN)

Multi-Domain (SAN)

CodeMarkdown

Защищает несколько разных доменов:
- example.com
- example.ru
- another-site.com

Let's Encrypt: free certificates

Installing Certbot

Ubuntu/Debian:

CodeShell

sudo apt update
sudo apt install certbot python3-certbot-nginx

CentOS/RHEL:

CodeShell

sudo dnf install certbot python3-certbot-nginx

Obtaining a certificate

For Nginx:

CodeShell

sudo certbot --nginx -d example.com -d www.example.com

For Apache:

CodeShell

sudo certbot --apache -d example.com -d www.example.com

Standalone (without a web server):

CodeShell

sudo certbot certonly --standalone -d example.com

Webroot (server is running):

CodeShell

sudo certbot certonly --webroot -w /var/www/html -d example.com

Wildcard certificate

Requires DNS validation:

CodeShell

sudo certbot certonly --manual --preferred-challenges dns \
  -d example.com -d "*.example.com"

Certbot will ask you to create a DNS TXT record:

CodeText

_acme-challenge.example.com TXT "random-string-here"

Automatic renewal

CodeShell

# Проверка автообновления
sudo certbot renew --dry-run

# Crontab (обычно настраивается автоматически)
0 0,12 * * * root certbot renew --quiet

Configuring web servers

Nginx — optimal configuration

CodeNginx

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;
    
    # Сертификаты
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    
    # Современные протоколы
    ssl_protocols TLSv1.2 TLSv1.3;
    
    # Безопасные шифры
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    
    # OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    
    # Session cache
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;
    
    # HSTS
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    
    root /var/www/example.com;
    index index.html;
}

Apache

CodeApache

<VirtualHost *:80>
    ServerName example.com
    Redirect permanent / https://example.com/
</VirtualHost>

<VirtualHost *:443>
    ServerName example.com
    
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
    
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder off
    
    Header always set Strict-Transport-Security "max-age=31536000"
    
    DocumentRoot /var/www/example.com
</VirtualHost>

Checking SSL configuration

Testing tools

reChecker SSL Checker — quick certificate check
SSL Labs — detailed analysis (grade A-F)
OpenSSL — command-line check

Checking with OpenSSL

CodeShell

# Информация о сертификате
openssl s_client -connect example.com:443 -servername example.com

# Срок действия
echo | openssl s_client -connect example.com:443 2>/dev/null | \
  openssl x509 -noout -dates

# Цепочка сертификатов
openssl s_client -connect example.com:443 -showcerts

Checking supported protocols

CodeShell

# TLS 1.3
openssl s_client -connect example.com:443 -tls1_3

# TLS 1.2
openssl s_client -connect example.com:443 -tls1_2

Common problems and solutions

Mixed content

Problem: the page loads over HTTPS but contains HTTP resources.

CodeHTML

<!-- ❌ Плохо -->
<img src="http://example.com/image.jpg">
<script src="http://cdn.example.com/script.js"></script>

<!-- ✅ Хорошо -->
<img src="https://example.com/image.jpg">
<script src="https://cdn.example.com/script.js"></script>

<!-- ✅ Или относительные протоколы -->
<img src="//example.com/image.jpg">

Automatic fix using CSP:

CodeNginx

add_header Content-Security-Policy "upgrade-insecure-requests";

Certificate chain error

Problem: the browser does not trust the certificate.

CodeShell

# Проверка цепочки
openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt \
  /etc/letsencrypt/live/example.com/fullchain.pem

Solution: use fullchain.pem, not cert.pem.

Expired certificate

CodeShell

# Принудительное обновление
sudo certbot renew --force-renewal

# Проверка таймера systemd
systemctl list-timers | grep certbot

ERR_SSL_VERSION_OR_CIPHER_MISMATCH

Problem: outdated protocols or ciphers.

CodeNginx

# Обновите конфигурацию
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;

HSTS and Preload

What is HSTS

HTTP Strict Transport Security forces the browser to always use HTTPS:

CodeNginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

HSTS Preload

Adding a domain to the list of domains that browsers load only over HTTPS:

Configure the header:

CodeNginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Submit the domain to https://hstspreload.org

Important: Removing a domain from the preload list is difficult! Make sure the entire site works over HTTPS.

Certificate monitoring

Certificate expiration check script

CodeShell

#!/bin/bash
# check-ssl-expiry.sh

DOMAIN=$1
DAYS_WARNING=30

EXPIRY=$(echo | openssl s_client -connect ${DOMAIN}:443 2>/dev/null | \
         openssl x509 -noout -enddate | cut -d= -f2)
EXPIRY_EPOCH=$(date -d "${EXPIRY}" +%s)
NOW_EPOCH=$(date +%s)
DAYS_LEFT=$(( ($EXPIRY_EPOCH - $NOW_EPOCH) / 86400 ))

if [ $DAYS_LEFT -lt $DAYS_WARNING ]; then
    echo "WARNING: ${DOMAIN} expires in ${DAYS_LEFT} days"
    exit 1
fi

echo "OK: ${DOMAIN} expires in ${DAYS_LEFT} days"
exit 0

CodeShell

# Crontab для ежедневной проверки
0 9 * * * /path/to/check-ssl-expiry.sh example.com

SSL configuration checklist

Conclusion

An SSL certificate in 2026 is a basic necessity. Let's Encrypt has made certificates free and accessible. Key recommendations:

Use TLS 1.3 — it is faster and more secure
Configure HSTS — protection against downgrade attacks
Automate renewal — Let's Encrypt certificates are valid for 90 days
Monitor — use reChecker SSL Checker for regular checks

Don't forget to check security headers using Security Headers — SSL is only part of a secure configuration.

SSL/TLS basics

What are SSL and TLS

SSL (Secure Sockets Layer) is an obsolete encryption protocol. The last version of SSL 3.0 was deemed insecure in 2015.

TLS (Transport Layer Security) is the modern protocol that replaced SSL. The current versions are:

TLS 1.2 — the minimum acceptable version
TLS 1.3 — the recommended version (faster and more secure)

The term “SSL certificate” is used by tradition, but technically this is a TLS certificate.

How HTTPS works

CodeMarkdown

1. Клиент → Сервер: "Привет, поддерживаю TLS 1.3, шифры: X, Y, Z"
2. Сервер → Клиент: "Выбрал TLS 1.3, шифр X. Вот мой сертификат"
3. Клиент проверяет:
   - Сертификат выдан доверенным CA
   - Домен совпадает
   - Срок действия не истёк
4. Клиент и сервер генерируют сессионный ключ
5. Дальнейшее общение зашифровано

Types of SSL certificates

By validation level

1. DV (Domain Validation)

Validation: domain ownership
Issuance time: minutes
Price: free (Let's Encrypt) — $50/year
Suitable for: blogs, personal websites, small projects

2. OV (Organization Validation)

Validation: domain ownership + organization existence
Issuance time: 1-3 days
Price: $50-200/year
Suitable for: business websites, corporate portals

3. EV (Extended Validation)

Validation: full legal entity verification
Issuance time: 1-2 weeks
Price: $200-500/year
Suitable for: banks, payment systems, large e-commerce sites

By number of domains

Single Domain

CodeText

Защищает: example.com
Не защищает: www.example.com, blog.example.com

Wildcard

CodeText

Защищает: *.example.com
Примеры: www.example.com, blog.example.com, api.example.com
Не защищает: example.com (нужен отдельный или SAN)

Multi-Domain (SAN)

CodeMarkdown

Защищает несколько разных доменов:
- example.com
- example.ru
- another-site.com

Let's Encrypt: free certificates

Installing Certbot

Ubuntu/Debian:

CodeShell

sudo apt update
sudo apt install certbot python3-certbot-nginx

CentOS/RHEL:

CodeShell

sudo dnf install certbot python3-certbot-nginx

Obtaining a certificate

For Nginx:

CodeShell

sudo certbot --nginx -d example.com -d www.example.com

For Apache:

CodeShell

sudo certbot --apache -d example.com -d www.example.com

Standalone (without a web server):

CodeShell

sudo certbot certonly --standalone -d example.com

Webroot (server is running):

CodeShell

sudo certbot certonly --webroot -w /var/www/html -d example.com

Wildcard certificate

Requires DNS validation:

CodeShell

sudo certbot certonly --manual --preferred-challenges dns \
  -d example.com -d "*.example.com"

Certbot will ask you to create a DNS TXT record:

CodeText

_acme-challenge.example.com TXT "random-string-here"

Automatic renewal

CodeShell

# Проверка автообновления
sudo certbot renew --dry-run

# Crontab (обычно настраивается автоматически)
0 0,12 * * * root certbot renew --quiet

Configuring web servers

Nginx — optimal configuration

CodeNginx

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;
    
    # Сертификаты
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    
    # Современные протоколы
    ssl_protocols TLSv1.2 TLSv1.3;
    
    # Безопасные шифры
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    
    # OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    
    # Session cache
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;
    
    # HSTS
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    
    root /var/www/example.com;
    index index.html;
}

Apache

CodeApache

<VirtualHost *:80>
    ServerName example.com
    Redirect permanent / https://example.com/
</VirtualHost>

<VirtualHost *:443>
    ServerName example.com
    
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
    
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
    SSLHonorCipherOrder off
    
    Header always set Strict-Transport-Security "max-age=31536000"
    
    DocumentRoot /var/www/example.com
</VirtualHost>

Checking SSL configuration

Testing tools

reChecker SSL Checker — quick certificate check
SSL Labs — detailed analysis (grade A-F)
OpenSSL — command-line check

Checking with OpenSSL

CodeShell

# Информация о сертификате
openssl s_client -connect example.com:443 -servername example.com

# Срок действия
echo | openssl s_client -connect example.com:443 2>/dev/null | \
  openssl x509 -noout -dates

# Цепочка сертификатов
openssl s_client -connect example.com:443 -showcerts

Checking supported protocols

CodeShell

# TLS 1.3
openssl s_client -connect example.com:443 -tls1_3

# TLS 1.2
openssl s_client -connect example.com:443 -tls1_2

Common problems and solutions

Mixed content

Problem: the page loads over HTTPS but contains HTTP resources.

CodeHTML

<!-- ❌ Плохо -->
<img src="http://example.com/image.jpg">
<script src="http://cdn.example.com/script.js"></script>

<!-- ✅ Хорошо -->
<img src="https://example.com/image.jpg">
<script src="https://cdn.example.com/script.js"></script>

<!-- ✅ Или относительные протоколы -->
<img src="//example.com/image.jpg">

Automatic fix using CSP:

CodeNginx

add_header Content-Security-Policy "upgrade-insecure-requests";

Certificate chain error

Problem: the browser does not trust the certificate.

CodeShell

# Проверка цепочки
openssl verify -CAfile /etc/ssl/certs/ca-certificates.crt \
  /etc/letsencrypt/live/example.com/fullchain.pem

Solution: use fullchain.pem, not cert.pem.

Expired certificate

CodeShell

# Принудительное обновление
sudo certbot renew --force-renewal

# Проверка таймера systemd
systemctl list-timers | grep certbot

ERR_SSL_VERSION_OR_CIPHER_MISMATCH

Problem: outdated protocols or ciphers.

CodeNginx

# Обновите конфигурацию
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;

HSTS and Preload

What is HSTS

HTTP Strict Transport Security forces the browser to always use HTTPS:

CodeNginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

HSTS Preload

Adding a domain to the list of domains that browsers load only over HTTPS:

Configure the header:

CodeNginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Submit the domain to https://hstspreload.org

Important: Removing a domain from the preload list is difficult! Make sure the entire site works over HTTPS.

Certificate monitoring

Certificate expiration check script

CodeShell

#!/bin/bash
# check-ssl-expiry.sh

DOMAIN=$1
DAYS_WARNING=30

EXPIRY=$(echo | openssl s_client -connect ${DOMAIN}:443 2>/dev/null | \
         openssl x509 -noout -enddate | cut -d= -f2)
EXPIRY_EPOCH=$(date -d "${EXPIRY}" +%s)
NOW_EPOCH=$(date +%s)
DAYS_LEFT=$(( ($EXPIRY_EPOCH - $NOW_EPOCH) / 86400 ))

if [ $DAYS_LEFT -lt $DAYS_WARNING ]; then
    echo "WARNING: ${DOMAIN} expires in ${DAYS_LEFT} days"
    exit 1
fi

echo "OK: ${DOMAIN} expires in ${DAYS_LEFT} days"
exit 0

CodeShell

# Crontab для ежедневной проверки
0 9 * * * /path/to/check-ssl-expiry.sh example.com

SSL configuration checklist

Conclusion

An SSL certificate in 2026 is a basic necessity. Let's Encrypt has made certificates free and accessible. Key recommendations:

Use TLS 1.3 — it is faster and more secure
Configure HSTS — protection against downgrade attacks
Automate renewal — Let's Encrypt certificates are valid for 90 days
Monitor — use reChecker SSL Checker for regular checks

Don't forget to check security headers using Security Headers — SSL is only part of a secure configuration.

SSL/TLS basics

What are SSL and TLS

How HTTPS works

Types of SSL certificates

By validation level

By number of domains

Let's Encrypt: free certificates

Installing Certbot

Obtaining a certificate

Wildcard certificate

Automatic renewal

Configuring web servers

Nginx — optimal configuration

Apache

Checking SSL configuration

Testing tools

Checking with OpenSSL

Checking supported protocols

Common problems and solutions

Mixed content

Certificate chain error

Expired certificate

ERR_SSL_VERSION_OR_CIPHER_MISMATCH

HSTS and Preload

What is HSTS

HSTS Preload

Certificate monitoring

Certificate expiration check script

SSL configuration checklist

Conclusion

Terms by topic

SSL certificate: what it is and why it’s needed

DNS: what it is and how it works

HSTS: what it is and why it is needed

HTTP/2: what it is and why it is needed

SSL certificate error: how to identify the cause and fix it

Website not opening over HTTPS: step-by-step diagnosis

CSP Report-Only: How to test a policy without blocking

Check your website

Feedback

SSL/TLS basics

What are SSL and TLS

How HTTPS works

Types of SSL certificates

By validation level

By number of domains

Let's Encrypt: free certificates

Installing Certbot

Obtaining a certificate

Wildcard certificate

Automatic renewal

Configuring web servers

Nginx — optimal configuration

Apache

Checking SSL configuration

Testing tools

Checking with OpenSSL

Checking supported protocols

Common problems and solutions

Mixed content

Certificate chain error

Expired certificate

ERR_SSL_VERSION_OR_CIPHER_MISMATCH

HSTS and Preload

What is HSTS

HSTS Preload

Certificate monitoring

Certificate expiration check script

SSL configuration checklist

Conclusion

Terms by topic

SSL certificate: what it is and why it’s needed

DNS: what it is and how it works

HSTS: what it is and why it is needed

HTTP/2: what it is and why it is needed

SSL certificate error: how to identify the cause and fix it

Website not opening over HTTPS: step-by-step diagnosis

CSP Report-Only: How to test a policy without blocking

Check your website