What is an SSL certificate? A plain guide for business owners in Saudi Arabia

In this guide

1. What an SSL certificate is
2. DV, OV and EV
3. Free vs paid
4. Browser warnings and mixed content
5. Renewal and shorter lifetimes
6. Forms, logins and payments
7. Who should own the certificate
8. An SSL checklist
9. SSL on Webnaa websites
10. FAQ
11. Summary

What is an SSL certificate, in plain terms?

An SSL certificate is a small data file installed on the server that hosts your website. It is issued by a certificate authority (CA), an organisation that browsers and operating systems have agreed to trust. Before issuing it, the CA checks that whoever is asking really controls your domain. Once installed, the certificate does two jobs: it lets a visitor's browser confirm it is talking to the real server for your domain, and it allows everything exchanged between them to be encrypted.

SSL, TLS and HTTPS: three names, one idea

SSL (Secure Sockets Layer) was the original protocol for securing web traffic. It was replaced long ago by TLS (Transport Layer Security), and modern browsers only accept recent TLS versions. The industry never dropped the old name, so hosts and CAs still sell "SSL certificates" that are really TLS certificates. HTTPS is simply HTTP running over TLS: when a certificate is working, your address starts with https:// instead of http://.

How a certificate is issued

Let's Encrypt, a nonprofit CA, describes the process openly. Software on your server asks the CA for a certificate for your domain. The CA replies with a challenge: place a specific file on your site, or add a specific DNS record. When the challenge is met, the CA knows the request came from someone in control of the domain and issues the certificate. Its FAQ also notes that the private key, the secret half that makes encryption work, is generated and kept on your own server and never stored by the CA. Every hosting control panel with a "free SSL" button runs a version of this behind the scenes.

What the padlock proves, and what it does not

For years browsers showed a padlock next to secure addresses; some now show a site-settings icon instead, but the meaning is the same. It proves three things: the connection is encrypted, the page was not altered on its way to the visitor, and the certificate was issued for this exact domain by a trusted CA. That protects a customer filling in your enquiry form on hotel or airport Wi-Fi.

It does not prove that the business behind the site is genuine; scam sites get free certificates as easily as anyone. It does not mean the site is clean; a hacked site can serve malware over a perfectly valid HTTPS connection. And it says nothing about how data is stored once it reaches the server.

DV, OV and EV: which validation level do you need?

Certificates differ in two ways: how much the CA checks before issuing (the validation level) and how many names they cover. The encryption itself is essentially the same across all of them. An expensive certificate does not encrypt "harder".

Type	What the CA checks	Issuance	What visitors see	Typical fit
Domain Validation (DV)	Control of the domain only, via a file or DNS record	Automated, usually minutes	A secure connection; no company name	Most company sites, blogs, landing pages and small stores
Organisation Validation (OV)	The domain plus the organisation's existence and legal name, from official documents	Manual review, takes longer	The same address-bar icon; the company name appears in the certificate details	Firms whose group policy, clients or tenders ask for verified organisation details
Extended Validation (EV)	Stricter checks on the organisation, its legal status and the requester's authority	Longest process, more paperwork	No visible difference in the address bar of current major browsers	Organisations bound to EV by contract or regulator

A word on EV. Browsers once displayed the company name in the address bar for EV certificates, and that is what many sales pitches still describe. Current major browsers no longer do this, so an EV certificate will not give your customers a visible trust badge. Buy one only if a written requirement says you must.

Coverage: one name, several names or a wildcard

Many Gulf businesses run more than one address: a .sa domain and a .com, an English site on en.example.sa, a booking system on book.example.sa. Coverage decides whether one certificate protects them all:

According to the Let's Encrypt FAQ, its free certificates can include several names, and it also issues wildcard certificates, which require proving control through a DNS record. Wide coverage alone is no longer a reason to pay.

Free vs paid SSL certificates: what the money buys

Let's Encrypt states that it charges no fee for its certificates, that it issues DV certificates only and has no plans for OV or EV (because those cannot be automated), and that most browsers and operating systems trust them. Most hosting panels install these certificates for you. The same FAQ notes that some hosting providers charge a small fee to cover their own costs of managing them.

So what does a paid certificate actually add? Usually some combination of the following:

• Organisation validation: OV or EV checks that free CAs do not offer.
• Vendor support: a CA or reseller you can call, instead of community forums.
• A warranty: a written financial warranty from the CA, which some procurement teams like to see.
• Compatibility with legacy kit: occasionally useful for old devices or internal systems that cannot run automated renewal.

What it does not add: speed, better Google rankings, protection against hacking, or stronger encryption for your visitors. Prices for paid certificates vary widely between CAs and resellers, so compare on the validation type, the names covered, the lifetime and how renewal is automated before you compare on price.

A practical example: a foreign-owned consultancy in Riyadh runs a bilingual brochure site with a contact form. A free DV certificate covering the domain, www and the en. subdomain is all it needs. Its sister company, which bids on contracts whose security annex asks for organisation-validated certificates, has a real reason to buy OV. Same group, different answers, and both are right. If you are still choosing a host, our guide to the types of web hosting explains what to look for alongside SSL.

Browser warnings and mixed content

Warnings are where certificate problems cost you customers. Each has a usual cause:

• "Not secure" next to the address: the page loads over plain http with no certificate. Install one and redirect every http address to https.
• A full-page "your connection is not private" warning: most often an expired certificate. Renew now, then fix the automation that failed.
• The same warning mentioning a name mismatch: the certificate does not cover the address typed, often www or a subdomain. Add the name.
• An "untrusted" certificate: a self-signed certificate, or intermediate certificates missing on the server. Install a CA-issued certificate with its full chain.

Warnings are also becoming harder to ignore. In October 2025, Google's security blog announced that, with Chrome 154 in October 2026, Chrome would turn on "Always Use Secure Connections" by default. In that mode Chrome asks the user's permission before the first visit to any public site without HTTPS. A site without a certificate no longer just shows a small label; a new visitor may meet a warning page before seeing your homepage. If that visitor came from a paid ad, you have paid for the click and lost the lead.

Mixed content: when the padlock disappears anyway

MDN defines mixed content as a page loaded securely over HTTPS that still fetches some resources, such as images or scripts, over insecure HTTP. Those resources can be read or altered in transit, so the page is no longer fully safe. MDN explains that browsers now upgrade image, audio and video requests to HTTPS automatically and block other insecure resources, including scripts, stylesheets and iframes.

To a business owner, this shows up as odd symptoms rather than error messages: a missing image, an embedded booking widget or map that never loads, a broken layout, or a padlock that will not appear. It is most common after an older site moves to HTTPS and keeps hard-coded http:// links in its database, theme or embed codes.

1. Open your key pages, not just the homepage, and check the browser's developer console for mixed content warnings, as MDN recommends.
2. Take a backup, then replace http:// with https:// in your settings, theme and content. On WordPress, start with the site address in General Settings, then use a reputable search-and-replace tool on the database.
3. If a third-party resource has no HTTPS version, replace the service or host the file yourself.
4. Re-check after adding any plugin, widget or tracking code. One line can bring the problem back.

Renewal: certificates are getting shorter

Every certificate has an expiry date, and the direction is clear: shorter lifetimes and full automation. Let's Encrypt's default certificates currently last 90 days, and it recommends renewing every 60 days. In December 2025 it announced a staged reduction: from 10 February 2027 its default certificates will last 64 days, and from 16 February 2028, 45 days. It explains that this is happening across the industry because the CA/Browser Forum Baseline Requirements, the rules every publicly trusted CA must follow, require it. In other words, paid certificates are getting shorter too.

The same announcement says most users with automated renewal will not need to change anything, recommends against manual renewal, and advises monitoring that alerts you if a certificate is not renewed on time. For a business, that translates into three questions for whoever runs your site:

1. Does the certificate renew automatically on the server, with no person involved?
2. If renewal fails, who is alerted, and how many days before expiry?
3. Does renewal cover every name: the bare domain, www and each subdomain?

Consider a regional distributor whose IT partner in another country buys a one-year certificate and installs it by hand each spring. As lifetimes fall to a few weeks, that routine becomes a recurring task that is easy to miss during a holiday or a staff change. The day it slips, every visitor sees a warning, and nobody inside the company may notice until a customer calls.

SSL for forms, logins and online payments

Any page where a visitor types something needs HTTPS: contact and quote forms, bookings, account logins and your own admin dashboard. The sound approach is to run the whole site over HTTPS rather than protecting selected pages, because visitors move between pages and one insecure page can be tampered with to send a form somewhere else.

Payments are often misunderstood. On most small business sites, the card number is never typed into your own pages: the customer enters it on the payment gateway's hosted page or in a secure field the gateway controls. The certificate is still essential. Your cart and checkout pages carry the customer's name, address and phone number, and the hand-off to the gateway has to start from a secure page. That is why payment gateways typically expect your site to run on HTTPS before they enable live payments. If you sell online in the Kingdom, our WooCommerce setup guide for Saudi Arabia covers connecting mada and Apple Pay.

Encrypting data in transit is also only one part of handling personal data responsibly. For the wider picture on privacy notices, consent and data handling, see our PDPL website compliance checklist.

Who in your company should own the certificate?

Certificate failures are usually ownership gaps, not technical mysteries: the domain is registered to a former employee, renewal emails go to an old agency, or head office and the local team each assume the other is handling it. This is common in foreign-owned companies, where the website, the domain and the IT budget can sit in three countries.

A simple ownership model avoids most of it:

• The domain and DNS are registered in the company's name, with login details held by at least two people.
• Certificate and domain alerts go to a shared company mailbox, such as it@ or web@ on your own domain, not to one person. Our business email guide explains how to set one up.
• One named owner, inside the company, confirms each quarter that renewal is automated and working, even if a vendor does the technical work.
• Group requirements are written down. If your parent company's security policy or a client's questionnaire asks for OV certificates or specific TLS settings, keep that requirement on file so local suppliers can meet it.

If you are moving a site between providers, plan the certificate as part of the move: the new server needs a valid certificate for every name before DNS is switched, or visitors will see warnings during the changeover.

An SSL checklist for your website

Work through these steps on your current site, or send them to whoever manages it. The first one needs no technical skill and catches most problems on its own.

Once everything runs cleanly on HTTPS, your developer can enable HSTS, a setting that tells browsers to use only secure connections for your domain. Enable it only after every subdomain works over HTTPS, because browsers that have seen the setting keep applying it for a period even if you change your mind.

For the full pre-launch list, see our website launch checklist. And if a sudden warning appears together with strange pages or redirects to other sites, the certificate may not be the problem at all; follow our hacked website recovery guide instead.

SSL on Webnaa websites

With Webnaa you do not buy or renew a certificate yourself. Hosting and SSL are included in every plan at no extra cost, from a one-page site on a Webnaa subdomain at SAR 39 a month to websites on your own domain, so your site runs on HTTPS from launch day. Every plan also includes:

• Website content written for you, in Arabic, English or both, with a full interface for each language.
• Your design on a preview link within 24 hours of receiving your complete information, before it goes live on your domain.
• A domain registered in your name on every own-domain site.
• A money-back guarantee if you do not like the design during the design stage, under our refund policy.
• A consultation that is always free.

The price of a site on your own domain depends on its type, languages and number of pages, and you can see it in seconds in our price calculator. The website design service page sets out what the work covers, and our web design for businesses in Saudi Arabia homepage introduces Webnaa.

Already have a site showing warnings, or need to move a domain, hosting or business email? Our domain, hosting and business email service handles that on a written quote after a free consultation.

FAQ

Summary

So, what is an SSL certificate? It is the file that lets your website run on HTTPS: it encrypts the connection between your visitors and your server and keeps browsers from showing warnings that send customers away. It does not vouch for your business or protect the site from hacking, but no website can do without it. For most companies a free DV certificate is enough, provided it covers every address you use, renews automatically, alerts a shared mailbox when renewal fails, and sits on a site free of mixed content. As lifetimes keep shrinking, the important question is no longer which certificate to buy, but who makes sure it renews.

Sources (accessed 1 November 2026): Let's Encrypt FAQ on free DV certificates, coverage and lifetimes; Let's Encrypt: decreasing certificate lifetimes to 45 days; MDN: mixed content; Google Security Blog: HTTPS by default. From Webnaa: pricing and domain, hosting and email service.