An SSL certificate is a digital certificate that helps a browser authenticate a website’s server and establish an encrypted connection. Modern websites use TLS, the successor to SSL, although “SSL certificate” remains the familiar name. For an online store, a valid HTTPS connection protects information in transit. It does not prove that the merchant is trustworthy, the products are accurate, or checkout works.
That distinction matters when you connect a new domain. A browser can accept the certificate while showing the wrong storefront. A store can load correctly while its payment setup remains incomplete. Treat the certificate as one specific check, not a launch approval.
SSL, TLS, and HTTPS mean different things
SSL stands for Secure Sockets Layer. TLS stands for Transport Layer Security. HTTPS is the secure form of HTTP, the protocol a browser uses to exchange website content.
DigiCert’s SSL, TLS, and HTTPS explanation confirms that TLS replaced SSL while the older certificate name remains common. You do not need to ask for an obsolete SSL protocol because a hosting panel calls its control “SSL.”
| Term | What it describes | What a store owner should check |
|---|---|---|
| SSL certificate | The familiar name for the website’s digital certificate | The host provides a valid certificate for the address customers use |
| TLS | The protocol that protects the connection | The hosting service supports modern secure connections |
| HTTPS | HTTP carried over a secure connection | The public store and its customer-facing pages open without connection warnings |
The certificate contains information such as covered domain names, the issuer, validity dates, and a public key. AWS’s certificate overview explains how the browser checks the certificate, including whether it matches the requested domain, before establishing the protected session.
You do not need to inspect the cryptographic exchange to launch a store. You do need to know which address was tested and whether the browser accepted the connection without a warning.
What an SSL certificate proves, and what it does not
A valid certificate participates in authenticating the server for the requested hostname. TLS then protects the data exchanged over that connection. This is important for login credentials, customer information, and other information sent through the website.
Certificate validation and business validation are not interchangeable. A domain-validated certificate checks control of the domain; organization and extended-validation certificates involve additional identity checks. Fortinet’s certificate reference distinguishes these validation types. Do not infer a verified business identity from HTTPS alone.
Nor does a certificate certify the site’s behavior. It does not tell you whether a product claim is true, a refund policy is fair, or an administrator account is protected. An encrypted connection can still lead to a fraudulent website. DigiCert’s “Look Beyond the Lock” section makes that limitation explicit.
For your own store, separate the evidence:
| Evidence | What you have established | What remains unproven |
|---|---|---|
| DNS resolves to the required destination | The hostname routes where you expect | Certificate validity and correct storefront content |
| The platform accepts domain ownership | Its ownership requirement has passed | The browser’s HTTPS connection and the customer journey |
| The browser accepts HTTPS | The connection passed the browser’s checks | Product accuracy, cart behavior, payment readiness, and business legitimacy |
| A product reaches the intended checkout | That tested path works to that point | Other products, destinations, payment outcomes, and future changes |
This is why a security badge or a connected-domain indicator should not be your entire acceptance test. For the broader controls, use our secure ecommerce website checklist.
Check the exact address customers will use
example.com, www.example.com, and shop.example.com are different hostnames. A certificate must cover the hostname being requested. A working connection to one address does not, by itself, prove the others work.
List the addresses you intend to share. Open each one with https://, then check the final address after any redirect. If one redirects to another, both the initial secure connection and the destination need to work. Do not assume that a redirect will rescue a certificate error that occurs before the browser can receive it.
Use the browser’s site-information controls to inspect connection details when needed. The icon and menu wording vary between browsers, so look for the connection status rather than expecting a particular padlock color.
If you see a warning, record the exact hostname and error before changing anything. Do not bypass it to collect a customer’s details or declare the store ready. Ask the hosting provider or the person responsible for the site to investigate the named problem.
Keep DNS troubleshooting separate. A wrong destination needs correction; cached answers may need time to expire. Our DNS propagation guide helps distinguish those cases. Repeated speculative DNS changes make certificate and routing problems harder to isolate.
Use Runner’s domain status for the question it answers
Runner separates domain attachment, routing configuration, and ownership verification. A domain can have the right routing records while an ownership challenge is still pending. That is a connection requirement to complete, not evidence that you need to buy a different certificate.
The practical lesson is not to read “domain added” as “everything is ready.” Runner’s published custom-domain guide explains that distinction and owns the connection instructions. Use the exact records supplied for your domain rather than settings copied from a general article.
A connected status is not a substitute for opening the public HTTPS address. Once the connection is accepted, check the expected storefront, a real product, the cart, and the checkout path. Follow Runner’s live-store and checkout guide for those separate checks. Stop before a real purchase unless you intend to place that order and understand the charge and fulfillment effects.
If you are choosing a platform rather than troubleshooting a domain, review Runner’s ecommerce hosting workflow. Ask who owns certificate provisioning, renewal, and incident support before buying a separate certificate or attempting a manual installation. A managed host’s supported process may differ from a server you operate yourself.
Related questions
What is an SSL certificate used for?
It helps authenticate a website’s server and establish an encrypted connection. For a store, that protects information while it travels over the connection. It does not replace account security, application maintenance, accurate policies, or a tested checkout.
Is an SSL certificate the same as HTTPS?
No. The certificate is part of the authentication process. TLS protects the connection, and HTTPS is HTTP using that protected connection. In hosting interfaces, “SSL” is often the familiar label for modern TLS certificate management.
How do I get an SSL certificate for my store?
Start with your hosting provider’s supported domain and certificate instructions. Some managed services handle certificate work; a self-managed server can require a separate issuance and installation process. Confirm who handles renewal and which hostnames are covered. Do not buy a certificate before checking whether your host needs or accepts it.
How do I fix an SSL certificate error?
Capture the exact hostname and browser error, then check the host’s certificate guidance. A name mismatch, validity problem, or trust problem needs its own diagnosis. Compare DNS with the expected destination as a separate check. Do not treat every warning as propagation or ask customers to bypass it.
Does HTTPS mean my store is ready to sell?
No. It establishes a protected connection, not a complete store. Verify the intended product, available options, cart totals, delivery path, and payment setup at the final public address. That is the useful boundary of SSL certificate meaning for a merchant: protect the connection, then test the business flow.