If you have ever noticed the padlock icon in your browser's address bar, you have seen SSL in action. That small icon signals something important: the connection between your browser and the website is encrypted, protecting any data in transit from being intercepted. In 2026, SSL is not a nice-to-have feature for Canadian websites - it is an absolute necessity. This guide explains what SSL certificates are, why they matter, and how to set them up on your shared hosting account.
What Is an SSL Certificate?
SSL stands for Secure Sockets Layer (though modern implementations actually use TLS - Transport Layer Security). An SSL certificate is a small digital file installed on a web server that does two things:
- Authenticates the server - it proves that the domain belongs to who it claims to, verified by a trusted Certificate Authority (CA)
- Enables encryption - it establishes an encrypted connection so that data transmitted between the server and the visitor's browser cannot be read by anyone in between
When a website has a valid SSL certificate, its URL begins with https:// instead of http://, and browsers display a padlock icon.
Why Does Every Website Need HTTPS?
Security: HTTPS encrypts all data exchanged between your visitor and your server. This is critical for any form that collects personal information - contact forms, login fields, checkout pages - but it matters even for content-only sites because it protects the integrity of what visitors see.
Trust: Modern browsers display a "Not Secure" warning for sites without HTTPS. Many visitors will leave immediately upon seeing that warning rather than risk their data. A padlock tells visitors your site can be trusted.
SEO: Google confirmed that HTTPS is a ranking signal. All else being equal, a site with HTTPS will outrank an equivalent HTTP-only site in search results. For Canadian businesses competing for local search visibility, every advantage matters.
Privacy: HTTPS prevents internet service providers, network administrators, and others from monitoring the specific pages your visitors view on your site.
Types of SSL Certificates
Let's Encrypt (Free): Let's Encrypt is a free, automated Certificate Authority that issues domain-validated SSL certificates. These are fully trusted by all major browsers and are the standard choice for most websites. Many hosting providers - including dotCanada - offer Let's Encrypt certificates automatically with every hosting account.
Domain Validated (DV): The most common type, including Let's Encrypt. Validates only that you control the domain. Provides full encryption.
Organization Validated (OV): Requires verification of your organization's identity. The certificate includes your organization name. Good for business websites that want to display organizational credibility.
Extended Validation (EV): The highest validation level, requiring thorough vetting of the organization. Previously displayed the company name in a green bar; modern browsers have largely removed this visual distinction, making EV certificates less compelling than they once were for most use cases.
For the vast majority of Canadian websites, a free Let's Encrypt certificate is completely sufficient.
How to Install an SSL Certificate in cPanel
Option 1: AutoSSL (Simplest - Recommended)
Most cPanel shared hosting accounts include AutoSSL, which automatically provisions and renews free SSL certificates for your domains. To check if it is active:
- Log in to cPanel
- Under the Security section, click SSL/TLS Status
- You will see a list of your domains with their SSL status
- If any domain shows "AutoSSL Domain Validated" and a green checkmark, you are already protected
- If a domain shows "Not Secured," select it and click Run AutoSSL
AutoSSL certificates renew automatically, so you never need to worry about expiry.
Option 2: Installing a Certificate Manually
If you have purchased an SSL certificate from a third-party CA:
- In cPanel, go to Security > SSL/TLS
- Click Manage SSL sites
- Select your domain from the dropdown
- Paste in your certificate (CRT), private key, and CA bundle
- Click Install Certificate
Forcing HTTPS Redirects
Installing an SSL certificate alone does not automatically redirect visitors from http:// to https://. You need to set up a redirect. The easiest way in WordPress is to install a plugin like Really Simple SSL, which handles everything automatically. Alternatively, add this to your .htaccess file (accessible via File Manager in cPanel):
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
After adding the redirect, test your site to confirm it loads correctly over HTTPS before moving on.
Verifying Your SSL Certificate
After installing your certificate, verify it is working correctly:
- Visit your site in a browser and confirm the padlock appears
- Use a free tool like SSL Labs' SSL Test (
ssllabs.com/ssltest/) to check for any configuration issues - Check that all resources on your pages (images, scripts, stylesheets) load over HTTPS - mixed content warnings occur when a page is served over HTTPS but references HTTP resources
SSL and Canadian Privacy Law
For Canadian businesses, SSL is not just a best practice - it supports compliance with PIPEDA (the Personal Information Protection and Electronic Documents Act) and provincial privacy legislation. These laws require that personal information be protected with appropriate security safeguards. Encrypting data in transit with HTTPS is one of the most fundamental technical safeguards you can implement.
dotCanada includes free AutoSSL certificates with all shared hosting plans. Your website can be secured with HTTPS from day one at no extra cost. If you need help enabling HTTPS or troubleshooting an SSL issue, our team is here to walk you through it.
