SSL certificate

What it actually proves

Two things, and it is worth separating them. The certificate carries a public key, which lets the browser negotiate an encrypted session so nobody on the network can read or modify the traffic. And it carries a signature from a certificate authority, which vouches that the key belongs to the hostname in the certificate rather than to someone intercepting the connection.

Encryption without that second part would be useless: an attacker could serve their own encrypted connection just as easily.

Validation levels, and what the padlock does not mean

• Domain Validation (DV) — the authority only checks that you control the domain, usually by asking you to place a file or a DNS record. Issued in seconds, free from Let's Encrypt, and what almost every site uses.
• Organisation and Extended Validation (OV, EV) — the authority also verifies the legal entity. Costs money and takes days. Browsers stopped showing the company name in the address bar years ago, which removed most of the practical reason to buy one.

Here is the misconception: the padlock means the connection is encrypted and the hostname matches. It says nothing about whether the site is honest. Phishing sites have valid DV certificates because getting one is free and automatic.

Practical things that go wrong

Certificates are short-lived by design — Let's Encrypt issues for 90 days — so renewal has to be automated, and a broken renewal cron is the classic cause of a site going down on a random Sunday. A certificate also covers the exact names listed in it: example.com does not cover www.example.com or a subdomain unless the name is included or the certificate is a wildcard.

On a managed host you mostly do not deal with any of this. Firebase Hosting, Netlify, Cloudflare and NorthernGo's custom domains all provision and renew automatically once DNS points at them, which typically takes minutes to a few hours after the CNAME record resolves.