SSL Certificate Types, Auto-Renewal and Mixed Content
The difference between domain, organisation and extended validation certificates, Let's Encrypt's 90-day cycle, and how to fix mixed content errors.
rabbitclip teamPublished: 5 min read
Short answer
SSL certificates come in three validation levels: domain validation (DV), which only confirms ownership of the domain, organisation validation (OV), which also confirms the company exists, and extended validation (EV), which goes through the strictest checks. DV is enough for most sites and is renewed automatically, free of charge, every ninety days by services such as Let's Encrypt; OV and EV are usually chosen for corporate or financial sites.
When a business running an e-signature service sees its site throw an insecure connection warning because the certificate expired, that usually means auto-renewal failed silently. Even with renewal automated, whether the process is actually working still needs a separate check.
How do SSL certificate types differ?
An SSL certificate is a digital document that encrypts the connection between a website and a browser and verifies the site's identity. The three validation levels show how deeply the site's identity was checked, not how strong the encryption is.
- Domain validation (DV): only confirms the domain belongs to the applicant, issued within minutes
- Organisation validation (OV): confirms the company genuinely exists, checked against records such as a companies register
- Extended validation (EV): the strictest check, examining the company's legal existence and activity in detail
What does Let's Encrypt's ninety-day cycle mean?
Let's Encrypt is the most widely used free certificate authority, and it issues certificates valid for ninety days; per its own documentation, this period cannot be extended and has no exceptions. The short validity is meant to limit the damage if a certificate is ever stolen or misused.
That short cycle makes automated renewal a necessity; manual renewal would be too frequent a task to track reliably. Let's Encrypt recommends renewing every sixty days, leaving the remaining thirty as a buffer if something goes wrong.
Confirming auto-renewal actually works
Auto-renewal can turn into a setting nobody checks again once it is in place; a regular verification habit is worth keeping.
- Check the certificate's expiry date from the browser's padlock icon once a month
- Add an SSL certificate check to an uptime monitoring tool, so a warning arrives a set number of days before expiry
- Review the server-side renewal logs separately for any errors
- Confirm the account with authority to renew the certificate still belongs to the right, currently active person
When does a wildcard certificate make sense?
A wildcard certificate covers the main domain and every subdomain under it, for example *.example.com, with a single certificate; there is no need for a separate certificate for shop.example.com, blog.example.com and every other subdomain. That saves both time and ongoing management for a business running several subdomains.
The trade-off is that if one subdomain's certificate is ever compromised, the same key puts every other subdomain at risk too. For a small number of low-risk subdomains, a wildcard is practical; a subdomain handling payments or user logins is better served by its own separate certificate.
What is a mixed content error, and why does it show up?
If a page loads over https while an image, script or stylesheet inside it still gets fetched over plain http, the browser flags it as mixed content. Per MDN's security documentation, browsers usually block that request silently or show the visitor a warning.
This error most often comes from a site redesign or a leftover hardcoded http link from an old theme; even with a valid certificate installed, one missed update inside the page can break the padlock for the whole thing.
How to find and fix mixed content
The browser's developer console lists exactly which resource loaded over http; that is far faster than scanning the page by hand.
The lasting fix is replacing hardcoded http addresses with https, or using protocol-relative addresses. A site-wide rule that upgrades every http request to https adds an extra layer of protection, but it is not a substitute for fixing the source itself.
Common mistakes
Certificate management usually gets set up once and then forgotten; three mistakes repeat for that reason.
- Setting up auto-renewal and never checking on it again
- Not noticing renewal emails landing in a spam folder
- Skipping a mixed content check after a site migration or theme change
- Checking only the homepage and missing leftover http links on inner pages
Setting up an SSL certificate is a one-time job, but keeping it valid is an ongoing habit. Choosing the right certificate type, confirming auto-renewal actually works, and scanning regularly for mixed content are three details worth catching before they turn into a browser warning. A discovery call with rabbitclip is a good place to review your own certificate and security setup.
FAQ
Which certificate type is enough for a small business?
Domain validation (DV) is enough for most corporate sites and blogs. OV or EV suit financial sites or ones that need higher visible trust while taking payments.
Does a site become unreachable the moment a certificate expires?
The site usually still loads, but the browser shows an insecure connection warning; many visitors leave the moment they see it.
Does a mixed content error always show up visibly?
No, sometimes the browser blocks the resource silently; the issue only surfaces in the developer console or as a missing element on the page.
Is there any need to check once auto-renewal is set up?
Yes. Automated systems can fail too; a short check once a month catches the problem before a browser warning does.
Does a wildcard certificate make sense for every subdomain?
No. It is practical for low-risk subdomains, but a subdomain handling payments or logins is safer with its own separate certificate.
