SSL/TLS explained for business owners

Two things. First, that everything between the visitor's browser and your server is encrypted, so nobody on the path (a café Wi-Fi, an ISP, a compromised router) can read or alter it. Second, that a Certificate Authority has verified that the certificate was issued to the operator of that domain. The padlock is the browser's summary of both checks passing.

SSL is the older name; TLS is the current protocol. People say SSL and mean TLS. The certificate is the same product either way.

• Browsers label the site Not secure and, for expired or mismatched certificates, show a full-page warning most visitors will not click through.
• Login forms, customer details and card numbers travel as plain text.
• Payment gateways, app stores and many APIs refuse to integrate with unencrypted endpoints.
• Search engines treat HTTPS as a baseline, so an unencrypted site is at a disadvantage.

For most businesses, an OV certificate on the public site and DV certificates for internal tools is a sensible baseline. Banks and government portals usually go further.

1. 01Keep an inventory. Every domain, subdomain and API endpoint, with its expiry date and owner.
2. 02Renew early. Set reminders well before expiry. An expired certificate is the most common self-inflicted outage.
3. 03Protect the private key. It should live only on the server that uses it. If it leaks, revoke and reissue.
4. 04Use a licensed CA. Mango CA has issued SSL certificates in Bangladesh since 2011 and supports organizations that need certificates with local documentation and local support.