SSL certificates and the padlock
The padlock in the address bar is the most visible trust signal your site has — and the most misunderstood. Here is what it actually means, and what to do if it disappears.
The padlock is the most visible trust signal your website has, and the most misunderstood one. It makes a narrow promise, and it is worth knowing exactly which promise — particularly in healthcare, where patients are being asked to trust you with something.
What the padlock actually means
A certificate proves two things and no more:
- The connection is encrypted. Nobody on the coffee-shop Wi-Fi between the patient and your site can read or alter what passes.
- You control this domain. A certificate authority checked that whoever requested it could prove control of the name.
Why you need it anyway
- Browsers mark pages without it “Not secure” in the address bar — and worse next to any form field.
- Search engines treat HTTPS as a ranking signal, and modern browsers steer users to it by default.
- Any form that could carry patient information must be encrypted in transit. This is not optional in healthcare.
- Without it, anything you send can be modified in flight — including ad injection on public networks.
How it works on your site
Certificates are issued and renewed automatically. Modern certificates last around 90 days and renew well before expiry without anyone doing anything. That short life is a security feature, not a problem — automation makes it invisible.
The one thing that can interrupt renewal is a DNS change that breaks the validation check. This is why we verify certificates after any DNS work — see Understanding your DNS.
When a browser warns about your site
| “Not secure” | The page loaded over plain HTTP. Usually an old link or an internal link that hardcoded http://. |
|---|---|
| “Certificate has expired” | Renewal failed, generally because DNS changed. Needs attention the same day — visitors see a full-page warning. |
| “Does not match” | The certificate covers a different name — often yourpractice.com but not www.yourpractice.com, or vice versa. Both need covering. |
| “Not fully secure” | Mixed content: the page is HTTPS but pulls an image or script over HTTP. The padlock disappears even though the page loads. |
| “Not trusted” on one device only | Usually that device’s clock is badly wrong, or corporate security software is intercepting traffic. Check the date first. |
Checking it yourself
Click the padlock in any browser and choose to view the certificate — you will see who issued it, which names it covers, and when it expires. From a terminal:
echo | openssl s_client -connect yourpractice.com:443 -servername yourpractice.com 2>/dev/null | openssl x509 -noout -subject -dates
FAQ
Should we pay for a more expensive certificate?
For a practice website, no. Free automated certificates provide identical encryption. The paid tiers mainly add organisation validation, which browsers no longer display prominently — the visual difference patients used to see was removed years ago.
Does HTTPS make our site HIPAA compliant?
No. It secures data in transit, which is one necessary piece. Compliance also covers where the data lands, who can reach it, how long it is kept, and whether the vendors touching it have signed BAAs — see HIPAA and your website.
The padlock vanished after we added something to a page.
Almost certainly mixed content — an embedded video, tracking pixel or image loading over http://. Send us the page URL and we will find and fix the offending reference.