You've seen the padlock icon next to a website's address, and you've probably seen a scary browser warning on a site that doesn't have one. Here's what's actually happening, in plain terms.
What an SSL certificate actually does
An SSL certificate encrypts the connection between a visitor's browser and your website, so anything typed or loaded can't be read or altered by anyone in between.
Technically, most of the web now uses TLS (Transport Layer Security), the modern successor to the original SSL protocol — but "SSL" stuck as the everyday term, so you'll see both used interchangeably, including here. The certificate itself is a small file, issued by a trusted authority, that proves a site is who it claims to be and enables that encrypted connection. Without it, a browser shows the site as "Not Secure," and data sent to and from it travels in a form that could technically be intercepted and read.
This isn't a niche concern anymore — it's the baseline expectation for the web. As of January 2026, 92.6% of the top 100,000 websites use HTTPS by default, according to W3Techs, the web technology survey firm. A site without SSL today reads as an exception, not the norm.
Why you shouldn't have to set this up yourself
SSL certificates used to require manual setup: generating a certificate request, submitting it to a certificate authority, installing the result on a server, and remembering to renew it before it expired — usually every 90 days to a year. Getting any of those steps wrong could take a site offline or trigger browser warnings.
That's no longer how it typically works. Automated issuance — largely driven by Let's Encrypt, a free certificate authority that now accounts for the majority of certificates issued worldwide — means a modern host can request, install, and renew your certificate automatically, with no manual steps and no expiration date to track yourself.
sofast issues and renews your SSL certificate automatically the moment you connect a custom domain — it's part of the hosting, not a separate task on your list.
What this means for a site you built with AI
If you built your site with Claude, ChatGPT, or another AI tool, none of what's above is something you need to configure. It's handled at the hosting layer, automatically, the moment your domain is connected — one less unfamiliar acronym standing between you and a live site.
Frequently asked questions
Not on a modern static host. Automatic, free SSL is standard on platforms like sofast, issued the moment you connect your domain — no separate purchase or setup step.
Visitors would see a browser warning and the site would show as insecure, but with automatic renewal (standard on modern hosts), this shouldn't happen — the certificate renews itself before the old one expires.
Related, but not identical. SSL/TLS is the underlying encryption technology; HTTPS is the version of the web address protocol (https:// instead of http://) that uses it. In everyday conversation, people often use "SSL" and "HTTPS" interchangeably.
Yes — modern browsers flag any site without HTTPS as "Not Secure," regardless of what the site does, and search engines factor HTTPS into rankings. It's now a baseline expectation, not just a requirement for sites handling sensitive data.
Some hosts allow this for specific enterprise cases, but for the vast majority of sites, an automatically issued certificate provides the same encryption with none of the manual renewal risk.
Different jobs entirely — SSL encrypts the connection between a visitor and your site; it doesn't protect your computer from malware or block attacks the way security software does. They solve different problems.
Connecting a custom domain to your site automatically sets up SSL — here's how the full process works.
