SSL and HTTPS
Do I need a dedicated IP address for SSL?
Almost never. Browsers have supported Server Name Indication for well over a decade, which lets many HTTPS sites share one address. A dedicated IP only matters for a few legacy clients or specific setups, such as certain mail servers or firewall rules that need a fixed address. If a host charges extra for it "for SSL", ask why.
How often should I renew my SSL certificate?
As rarely as you can manage manually, and as often as automation wants. Current public certificates last under a year and the maximum keeps shrinking. Let your host or an ACME client handle it, and add monitoring that warns you if a renewal fails.
What does it mean when a browser says my connection is not private?
The browser cannot verify the site's certificate. Typical reasons: it has expired, it does not cover the name you typed, the intermediate certificates are missing, or the computer's clock is wrong. If it is your own site, check the certificate. If it is someone else's, do not proceed to enter any data.
Why does my site say Not Secure even with a certificate?
Usually mixed content: the page loads over HTTPS but includes some image, script or stylesheet over plain HTTP. Open the browser's console to see which resources. Update the addresses in your content, theme or database.
Do I need a certificate for a subdomain?
Yes, each hostname needs to be covered. You can use a certificate listing the names you need, or a wildcard that covers all first-level subdomains. Many hosts issue certificates automatically for each subdomain you create.
What is the difference between SSL and TLS?
TLS is the modern protocol; SSL is its older predecessor, now retired. People say SSL out of habit, and certificates are still sold as SSL certificates. In practice, you are always using TLS.
Can a certificate be installed on more than one server?
Technically yes, if you copy the private key. Many authorities allow it. It is cleaner and safer to give each server its own certificate, and use automation so every server renews independently.
What should I do if my private key is exposed?
Treat the certificate as compromised: request a new one with a new key, install it and revoke the old certificate. Find out how it leaked, and change anything else that was stored alongside it.
Will an expired certificate affect my search ranking?
Briefly, you may lose traffic because visitors bounce from the warning page and crawlers may be unable to fetch pages. Rankings usually recover once the certificate is fixed, but the visits in between are gone.