An SSL certificate lets a browser verify it is talking to the server it intended to reach, and encrypt everything exchanged. Modern connections actually use TLS — SSL is the older protocol it replaced — but the industry kept the older name for the product, and everyone still says SSL certificate.
What is actually being verified
Certificates differ in how much the certificate authority checks before issuing. There are three tiers.
Domain Validation (DV) proves control of the domain and nothing else. It is issued in seconds, automatically, and is what the large free certificate authorities provide. The encryption is identical to every other tier.
Organisation Validation (OV) additionally verifies that a real legal entity exists. Extended Validation (EV) applies a more thorough vetting process.
The important point, and the one that certificate sales pages avoid: browsers no longer display OV or EV differently. The green company name in the address bar was removed years ago. For a website, DV gives users exactly the same visible result as a certificate costing several hundred euros a year.
How automated issuance proves control
Automated certificate authorities issue after you demonstrate control of the name, using one of two challenge types.
The HTTP challenge asks you to serve a specific file at a specific path over plain HTTP. It is simple and requires nothing but a working web server, but the name must already resolve to that server.
The DNS challenge asks you to publish a specific TXT record. It is slower because it depends on DNS updates, but it works before the server is reachable, works for servers with no public HTTP at all, and is the only method that can issue a wildcard.
Wildcards, and when you need one
A wildcard certificate covers a domain and all subdomains at one level: *.example.com matches www.example.com and api.example.com, but not a.b.example.com.
Wildcards are convenient when you create subdomains often or dynamically. They come with a real trade-off: one private key now protects every subdomain, so a compromise anywhere is a compromise everywhere. For a fixed set of names, listing them explicitly on one certificate is the safer choice.
Expiry is the actual risk
Certificates from automated authorities are valid for around 90 days, and the industry is moving toward shorter lifetimes still. That sounds like a burden and is in fact the opposite — a validity period short enough to require automation forces you to build renewal properly, once.
The failure mode to avoid is a certificate that renews automatically but is never reloaded by the running service. The file on disk is fresh, the process is still holding the old one in memory, and the site starts failing on a date nobody wrote down. Whatever automates renewal must also reload the web server.
Monitor expiry from outside the machine. A check that connects to your public port and reads the certificate the server actually presents will catch this; a check that reads the file will not.
Practical defaults
For nearly every website: a DV certificate, issued automatically, renewed automatically, with the service reloaded on renewal, covering the bare domain and www. Add a wildcard only when the number of subdomains makes explicit listing impractical, and treat its private key with proportionate care.