Ask most people what the padlock in the address bar means and you'll get some version of "the site is safe." It doesn't mean that, it has never meant that, and the gap between what it certifies and what people assume causes genuine problems.
What it actually certifies
An SSL certificate does two things. It encrypts the connection between the browser and the server, so anybody intercepting the traffic sees noise instead of credit card numbers. And it confirms the server presenting the certificate genuinely controls that domain name.
That's it. It says the pipe is private and the address is real. It says nothing whatsoever about whether the business at the other end is honest, competent, or even a business.
What it doesn't certify
- That the site is legitimate. Certificates are free and automated. A scam site can have a perfectly valid one within minutes, and the overwhelming majority now do.
- That your data is safe once it arrives. Encryption protects data in transit. What happens to it on the server is a completely separate question.
- That the site hasn't been compromised. A hacked site keeps its valid certificate. The padlock stays exactly where it was.
This matters because "look for the padlock" is still repeated as consumer safety advice, and it hasn't been useful guidance for years.
The failures actually worth watching for
Expiry
The big one. Certificates are typically issued for 90 days now and renew automatically — until the automation breaks. When one lapses, browsers throw a full-page interstitial warning that most visitors will not click past. The site is functionally offline, and the business usually finds out from a customer.
Mixed content
The page loads over HTTPS but pulls an image, script or stylesheet over plain HTTP. Browsers either block it or downgrade the padlock. Usually caused by a hard-coded URL somewhere in the content after a migration.
The wrong name on the certificate
A certificate covering example.com but not www.example.com, or vice versa. Half your visitors get a warning depending on which link they followed.
Chain problems
The certificate is valid but the server isn't sending the full chain. Desktop browsers often paper over this; some mobile browsers and API clients don't, so it presents as "it works for me" while a portion of visitors see errors.
What to actually do
Automate renewal, then watch the automation. That second half is the part people skip. A certificate that renews itself is only reliable while nothing else changes — and things change: DNS moves, a server rebuild, a firewall rule that blocks the validation request.
Set up an expiry check that alerts you weeks out, not hours. If you look after sites for other people, check the whole portfolio from one place rather than remembering each one individually, because remembering is exactly the thing that fails.
And when a client asks whether the padlock means their site is secure: the honest answer is that it means the connection is private, and security is a much bigger conversation than one icon.
We watch certificate expiry so nobody finds out the hard way.
See Monitoring plans →