What It Does
Two things. It encrypts the connection, so a form filled in at a coffee shop cannot be read by anyone on the same wifi. And it proves identity: a trusted authority has confirmed that whoever holds the certificate controls the domain, so a visitor at gableexterior.example is talking to that site and not a copy of it. The protocol doing the work is TLS; the certificate is the credential it uses.
Where They Come From
Let's Encrypt, a nonprofit authority, issues them free and automatically, and has since 2015. Every BizPinPro site gets one on launch and renews it on its own every sixty days. There is no reason for a small business site to pay for a certificate or to run without one. Paid certificates still exist for cases that need a verified company name in the certificate itself, which a local business does not.
Where It Goes Wrong
Expiry. A certificate that is not renewed stops working on its end date, and the site goes from a padlock to a red warning overnight. It is the most common way a healthy site becomes unreachable: nobody was watching the date. The second failure is a site that has a certificate but still serves pages over plain http, so some visitors get the secure version and some do not. Every BizPinPro site forces https on every page and is monitored for the certificate date, so an expiry would be caught weeks before it mattered.
How To Check It
Click the padlock in the browser's address bar. It shows who issued the certificate and when it expires. No padlock, or a warning, means the site is not secured.
The Foundation Connection
The certificate is the first item under Active Security in the Digital Foundation. It is also a ranking factor and a trust signal in one: Google has preferred https since 2014, and a visitor who sees a warning does not come back.
