Engineering Glossary · Transport Security
SSL certificate — Certificates: The Chain Decides the Handshake
A padlock in your desktop browser proves nothing about what an Android client or a payment gateway will do with the same chain.
The short answer
An SSL certificate is the credential that enables encrypted HTTPS and attests that the server genuinely controls the domain it claims — a public key bound to your hostname and signed by an authority browsers already trust.
The part that shows up as a performance and compatibility problem is the chain rather than the certificate itself. Your server must send the leaf plus every intermediate up to a trusted root. Desktop browsers cache intermediates they have seen elsewhere and will paper over a missing one; a mobile client or an API consumer that has never met it will fail, or will spend a round trip fetching it. Check what the server actually sends, not what your browser manages to reconstruct.
By the HostingFast team · Reviewed 24 August 2026
100+
Terms in the glossary
2 min
Average read time
Plain
English throughout
24/7
Humans if you get stuck
Strictly they are TLS certificates, but the older name stuck. Each binds a public key to your domain and carries the signature of a certificate authority browsers already trust, and that chain of trust surfaces at the very end as the padlock in the address bar.
Automation rewrote the economics. Issuing and renewal are machine work costing nothing, and every plan we run ships that way. Paid tiers survive for wildcard convenience and organisation-level validation where somebody's paperwork insists on it.
Check the chain, not the padlock
openssl s_client -connect example.com:443 -servername example.com prints the certificate chain exactly as the server presents it, along with a verify return code at the end. Zero is what you want. Anything else names the problem, and 'unable to get local issuer certificate' is the classic signature of a missing intermediate.
This matters because your browser is an unreliable witness. It may already hold the intermediate from another site and complete the chain silently, which is precisely why a site that looks fine on a laptop fails on an older Android handset or inside a payment gateway's callback. The command has no cache and no opinion, which is what makes it the right test.
OCSP stapling, and the round trip it removes
Without stapling, a client that wants to check whether your certificate has been revoked may go and ask the certificate authority itself — a DNS lookup, a connection and a request, all before your page starts rendering. With stapling, your server includes a signed, time-limited revocation response in the handshake and the client needs nobody else.
Confirm it with openssl s_client -status -connect example.com:443 and look for an OCSP response section rather than the words 'no response sent'. It is one of the few TLS settings with a directly measurable effect on first-visit latency, particularly for visitors on high-latency mobile connections.
Expiry as a monitored event, not a memory
Automatic renewal is the default here, which is what makes expiry a non-event. Where a certificate has been installed by hand, it needs a check rather than a calendar entry: echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -enddate returns the exact expiry date and belongs in a monitoring script.
The failure, when it comes, is total. A visitor meets a full-page interstitial warning rather than a degraded experience, API clients refuse to connect, and it happens at whatever hour the certificate happened to be issued. There is no partial version of this outage.
Where this lands on HostingFast
Free SSL is on every plan, issued as soon as your domain points at us and renewed automatically before it can lapse, and cryptographically it matches any paid DV certificate. Backups run daily on every plan, and restoring a file or a database is a single click in the panel, not a support ticket.
Read next: HTTPS for what sits on top, TLS for the handshake itself, Let's Encrypt for the automation, and Wildcard SSL for the subdomain case.
Definitions written for people who deploy
Every entry here started life as a support ticket. Rather than explain the same term for the two hundredth time, we wrote it down properly — with the openssl command that checks it and the return code that means it is right.
NVMe storage and LiteSpeed caching power every tier, from the smallest plan up — speed is the baseline here, not an upsell.
- 100+ entries, each with the mechanism spelled out
- Commands you can paste, numbers you can compare against
- Neighbouring terms wired together at the foot of every page
- Written by the engineers who answer the tickets
Why HostingFast
Standard on every plan
The browser is not the test
Where a client's cache can mask a server fault, the entry gives you a command that has no cache of its own.
Return codes named
verify return code 0, and what the common non-zero ones actually mean, rather than 'check for errors'.
Latency attributed
Where a setting removes a round trip — stapling here — the entry says which round trip and for whom.
Total failures marked as total
Some faults degrade and some stop everything. Expiry is the second kind, and the entry says so plainly.
Wired to its neighbours
SSL Certificate runs into HTTPS, TLS, Let's Encrypt and Wildcard SSL — one subject in four parts.
This term, landed
Certificates defined, the chain verified and stapling confirmed — enough to sign off a deployment properly.
Quick Start
From order to online
- 1
Dump the chain the server sends
openssl s_client -connect example.com:443 -servername example.com, and read the verify return code at the end. Zero or nothing.
- 2
Confirm stapling is switched on
Add -status to the same command and look for an OCSP response rather than 'no response sent'. It is a free round trip for first-time visitors.
- 3
Put expiry in a monitor, not a diary
openssl x509 -noout -enddate against the live endpoint, checked on a schedule. Automatic renewal is the default here; hand-installed certificates are not.
Built In
Loaded onto every plan
- Free SSL on every plan, renewed automatically before it can lapse
- LiteSpeed caching built into the server rather than bolted on by plugin
- NVMe SSD storage on every tier, not only the expensive ones
- cPanel, so certificate status and installation sit on a screen you know
- WordPress and 400+ other applications installed in one click
- Daily backups with self-service restores you run yourself from the panel
- Money-back cover: 30 days on hosting plans, 7 on reseller
- DDoS filtering absorbed out at the network edge
- 99.9% uptime as the target, monitored around the clock
- Mailboxes on your own domain, included with the plan
Frequently Asked
What people ask us most often
How do I see the chain a server is actually sending?
openssl s_client -connect example.com:443 -servername example.com. It prints the certificates in the order the server offers them and finishes with a verify return code — zero is correct, and 'unable to get local issuer certificate' means an intermediate is missing. Use this rather than a browser, because a browser may already hold the intermediate and complete the chain for you.
Does the certificate itself affect page speed?
The certificate does not, but what surrounds it does. A missing intermediate can cost a client an extra fetch, and an unstapled OCSP response can cost it a whole round trip to the certificate authority before your content starts arriving. Both are configuration rather than cryptography, and both are worth checking on a first-visit basis rather than on a warm reload.
Technically, what does a paid certificate add over the free one?
Nothing in the encryption. Identical ciphers, identical browser trust, identical padlock — for an ordinary site the free automated certificate is complete cover. The reasons to buy are practical rather than technical: wildcard coverage at scale, organisation or extended validation because a procurement form asks for it, or a warranty that a compliance rule names.
How do I check an expiry date from the command line?
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -enddate returns notAfter with the exact date. Put it in a monitoring script rather than a calendar. On our plans renewal is automatic and this is a belt-and-braces check; on a hand-installed certificate it is the only thing standing between you and a full-page browser warning.
Keep reading
HTTPS
What runs on top of the certificate, and the redirect chain that quietly costs you round trips.
Let's Encrypt
The automation that issues and renews it, and the four things that stop a renewal silently.
How to Install an SSL Certificate
Installing one by hand, and verifying the chain before you trust the padlock.
Agency Hosting
Client accounts, staging and care-plan infrastructure engineered for agencies.
Web Hosting
Fast cPanel hosting on NVMe drives — SSL, migration and a year-one domain all included.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Ship it with the chain verified.
Free SSL on every plan renewing itself before it lapses, NVMe underneath, and support that will read an openssl dump with you.
View Agency Hosting plans