An SSL certificate (strictly a TLS certificate) lets your website use HTTPS, which encrypts traffic between visitors and your server and proves the site belongs to your domain. For most South African business websites, a free, automatically renewed Let's Encrypt certificate is all you need. Paid OV or EV certificates add verified company details, which some organisations need for policy or contractual reasons, but they do not make the encryption any stronger.
This guide explains how certificates work, which type to choose, how renewal works and how to fix the most common HTTPS problems.
What an SSL certificate does
When someone visits https://example.co.za, their browser and your server do a TLS handshake:
- The server presents its certificate, which contains your domain name and a public key.
- The browser checks the certificate was issued by a trusted certificate authority (CA), has not expired, and matches the domain being visited.
- The two sides agree on encryption keys, and all traffic from then on is encrypted.
That gives you three things:
- Encryption. Passwords, contact form details and card data cannot be read in transit.
- Integrity. Nobody on the network can alter the page as it travels, for example to inject adverts or malware.
- Authentication. Visitors know they are talking to the real
example.co.za.
Without HTTPS, browsers label your site "Not secure", and many modern web features only work over HTTPS. If your site collects any personal information, POPIA's security safeguards (section 19) also make encryption in transit a sensible baseline.
Types of certificate - DV, OV and EV
| Type | What the CA checks | Issued in | Typical use |
|---|---|---|---|
| Domain Validated (DV) | That you control the domain | Minutes, usually automated | Almost all websites, shops and apps |
| Organisation Validated (OV) | Domain control plus that the organisation exists | Days | Organisations whose policies require verified company details |
| Extended Validation (EV) | Stricter checks on the organisation's legal identity | Days to weeks | Some banks and large enterprises |
All three use the same encryption. The difference is how much identity checking the CA does and what details appear in the certificate. Modern browsers no longer show a prominent company name bar for EV certificates, so the visible difference to visitors is small. Choose OV or EV only if a policy, contract or client specifically requires it.
Let's Encrypt - free, automated DV certificates
Let's Encrypt is a non-profit certificate authority that issues free DV certificates through an automated protocol called ACME. It is trusted by all major browsers.
Key points:
- Short lifetimes. Let's Encrypt certificates are short-lived (90 days at the time of writing, with the industry moving towards shorter lifetimes still), so automatic renewal is essential. A good host renews them for you well before they expire.
- Validation. Let's Encrypt checks domain control either by requesting a file from your website over HTTP (HTTP-01) or by looking for a TXT record in your DNS (DNS-01). Your domain must already point to the server for the HTTP method to work.
- Wildcards. Wildcard certificates like
*.example.co.zaare available but require DNS validation.
On a self-managed server, you would use an ACME client such as Certbot:
sudo certbot --nginx -d example.co.za -d www.example.co.za
sudo certbot renew --dry-run
On managed hosting, this is normally a switch in the control panel, with renewal handled automatically.
Wildcard and multi-domain certificates
- Single-domain: covers
example.co.za(and usuallywww.example.co.za). - Multi-domain (SAN): covers several named domains in one certificate, for example
example.co.zaandexample.africa. - Wildcard: covers every first-level subdomain, like
shop.example.co.zaandblog.example.co.za, but not the bare domain unless it is added separately.
Common HTTPS problems and fixes
Mixed content warnings
The page loads over HTTPS but includes images, scripts or stylesheets over plain HTTP. Browsers block or warn about these. Fix it by updating hard-coded http:// links in your content, theme and database to https://, or to relative URLs. MDN's mixed content guide explains the rules.
Certificate does not match the domain
The certificate covers example.co.za but not www.example.co.za (or the other way round). Reissue the certificate including both names.
Expired certificate
Automatic renewal failed, often because the domain no longer points to the server, a DNS record changed, or a firewall blocked validation. Check the domain's DNS and your host's renewal logs.
Visitors still reach the HTTP version
Add a permanent (301) redirect from HTTP to HTTPS, and consider an HSTS header once everything works over HTTPS:
Strict-Transport-Security: max-age=31536000; includeSubDomains
Only add HSTS when you are sure every subdomain supports HTTPS, because browsers will refuse plain HTTP for the duration you set.
Moving hosts? Plan the certificate too
When you move a site, the new host usually cannot issue a Let's Encrypt certificate until the domain points to it, so there may be a brief window where the certificate is being issued. Plan the switch for a quiet time, or use DNS validation. Our guide to moving your website to a new host covers the full process, and how to point your domain to your hosting explains the DNS side.
SSL at NewHost
Every NewHost app and website gets a free Let's Encrypt SSL certificate, renewed automatically. It works for Next.js and Node.js apps as well as classic websites on Plesk. See SSL certificates for details, and our website security checklist for the next steps after HTTPS.
Frequently asked questions
Is a free SSL certificate good enough for an online store?
Yes. A free DV certificate provides the same encryption as a paid one. Payment security also depends on your payment provider and how your store handles card data, not on the certificate type.
Does HTTPS help SEO?
HTTPS is a lightweight ranking signal for Google, and avoiding "Not secure" warnings helps visitors trust your site. Content and speed still matter far more.
How often do SSL certificates need to be renewed?
Let's Encrypt certificates are short-lived and renewed automatically, typically well before they expire. Paid certificates also have maximum lifetimes that are shrinking over time, so automation is becoming the norm everywhere.
Why does my site show "Not secure" even though I have a certificate?
Usually it is mixed content (some resources loading over HTTP) or visitors reaching the HTTP version without a redirect. Fix the links and add a 301 redirect to HTTPS.
Do I need an SSL certificate if my site does not collect data?
Yes. Browsers flag all HTTP pages as not secure, HTTPS stops pages being tampered with in transit, and many browser features require it.
Want HTTPS that just works? Every plan on our pricing page includes free, auto-renewing Let's Encrypt SSL.