Do paid certificates offer anything over Let's Encrypt?

Cryptographically, nothing — the encryption is identical. Paid products differ in validation depth (organization checks), lifespan, warranties and support. For most sites, automated domain-validated certificates are the correct default; organization validation matters in contexts where displaying a verified legal identity does.

Why does my site show a certificate warning?

The browser could not complete the trust check: typically an expired certificate (automation broke), a name mismatch (certificate issued for a different domain or missing the www variant), or an incomplete chain to a trusted authority. Each is diagnosable in the browser's certificate details — expiry and mismatches are the everyday culprits.

What is SSL/TLS? — Getting Digital glossary

SSL/TLS

Also: TLS, SSL certificate, HTTPS encryption

TLS (still widely called SSL) is the protocol that encrypts traffic between browser and server and proves, via certificates, that the server really speaks for its domain — the mechanism behind the padlock and the S in HTTPS.

What the padlock actually promises

Two promises, precisely: nobody between browser and server can read or alter the traffic, and the server presented a certificate proving control of the domain you typed. That second promise is narrower than people assume — a phishing site can be perfectly encrypted. The padlock means 'private line to this domain', not 'this domain is honest'. SSL was the protocol's original name; TLS replaced it decades ago, but the old acronym survives in every product name and control panel.

Certificates come from certificate authorities (CAs) that browsers agree to trust, and the once-annual ritual of buying and installing one has collapsed into automation: Let's Encrypt issues domain-validated certificates free via the ACME protocol, and hosts, CDNs and platforms renew them silently. HTTPS everywhere is now table stakes — browsers mark plain HTTP 'not secure', search engines treat HTTPS as the norm, and modern web APIs simply refuse to run without it.

Where TLS ends

TLS protects data in transit — nothing more. It terminates at the web server or CDN edge; behind that point, and at rest in databases and backups, protection is a separate design question. 'We have SSL' is the beginning of a security posture, not the summary of one.

Key takeaways

→TLS delivers encrypted transport plus proof of domain control — privacy of the line, not honesty of the site.
→Certificates became free and automated (Let's Encrypt/ACME); if renewal is a manual calendar entry, the setup is a decade out of date.

Related concepts

RelatedWeb Server
TLS terminates at the web server (or CDN edge) — where certificates get configured.

FAQ

Do paid certificates offer anything over Let's Encrypt?: Cryptographically, nothing — the encryption is identical. Paid products differ in validation depth (organization checks), lifespan, warranties and support. For most sites, automated domain-validated certificates are the correct default; organization validation matters in contexts where displaying a verified legal identity does.
Why does my site show a certificate warning?: The browser could not complete the trust check: typically an expired certificate (automation broke), a name mismatch (certificate issued for a different domain or missing the www variant), or an incomplete chain to a trusted authority. Each is diagnosable in the browser's certificate details — expiry and mismatches are the everyday culprits.