An SSL certificate is a digital file that authenticates a website's identity and enables encrypted data transmission via HTTPS. It binds a domain name to a public cryptographic key, allowing browsers to verify they are talking to the genuine site — not an impostor — and to encrypt all data exchanged between the browser and server. Despite the name, modern certificates use TLS (Transport Layer Security), not the deprecated SSL protocol.
In 2026, having an SSL certificate is table stakes. Any site without HTTPS displays browser security warnings that kill conversions and signal untrustworthiness to every visitor. It is also a direct Google ranking signal. The only question is which type of certificate to get — and how to keep it renewed without downtime.
What is an SSL certificate?
An SSL certificate (more accurately called a TLS certificate) is a small data file issued by a Certificate Authority (CA) — a trusted third party that verifies identities on the internet. The certificate contains:
- The domain name the certificate covers
- The organisation name (for OV and EV certificates)
- The certificate's validity period
- The CA that issued it
- A public cryptographic key used to establish the encrypted connection
- A digital signature from the CA confirming the information is genuine
When a browser visits an HTTPS site, the server presents this certificate. The browser checks the CA's signature against its built-in trust store (a list of trusted CAs included with every operating system and browser). If the certificate is valid, trusted, and matches the domain, the browser proceeds with an encrypted connection. If anything is wrong, the browser shows a security warning.
The "SSL" in "SSL certificate" refers to Secure Sockets Layer, the original encryption protocol developed by Netscape in the 1990s. SSL was deprecated in 2015 due to security vulnerabilities. Its successor, TLS (Transport Layer Security), is what all modern HTTPS connections use. The term "SSL certificate" persists in common use, but technically these are TLS certificates.
When your hosting provider says "SSL certificate", they mean a TLS certificate using TLS 1.2 or 1.3. Ensure your server is configured to use TLS 1.2 minimum — TLS 1.0 and 1.1 are deprecated and insecure. TLS 1.3 is the current gold standard and is supported by all modern browsers.
Why SSL certificates matter for SEO and trust
SSL certificates matter for three interconnected reasons: browser security indicators, search engine ranking, and data security.
Browser security warnings
Since 2018, Chrome marks all HTTP sites as "Not Secure" in the address bar. Firefox, Safari, and Edge do the same. For a site selling products or collecting any form data, this warning is conversion death — studies consistently show that users abandon sites with security warnings at dramatically higher rates than equivalent HTTPS sites.
Google ranking signal
Google confirmed HTTPS as a ranking factor in August 2014. The signal is described as a "lightweight" tiebreaker — not the dominant factor — but in competitive SERPs where quality is similar across results, the HTTPS advantage can make a difference. More importantly, the Page Experience signals that feed into ranking all implicitly assume HTTPS is present.
Data encryption
Without HTTPS, all data transmitted between the user's browser and your server is visible to anyone on the same network — ISPs, network admins, or anyone executing a man-in-the-middle attack. This includes form submissions, login credentials, and browsing behaviour. HTTPS encrypts all of this in transit.
Types of SSL/TLS certificates
Certificates differ in the level of identity verification the CA performs before issuance and in how many domains they cover.
| Type | What gets verified | Issuance time | Best for |
|---|---|---|---|
| DV (Domain Validated) | Domain ownership only | Minutes | Blogs, informational sites, small businesses |
| OV (Organisation Validated) | Domain + organisation identity | 1-3 days | Companies, e-commerce, B2B sites |
| EV (Extended Validation) | Domain + full legal entity verification | 1-5 days | Financial institutions, regulated industries |
| Wildcard | Domain + all subdomains (*.domain.com) | Minutes (DV) | Sites with multiple subdomains |
| Multi-domain (SAN) | Multiple domains in one certificate | Minutes to days | Managing multiple domains from one cert |
How SSL/TLS encryption works
When you visit an HTTPS site, the browser and server complete a "TLS handshake" before any page content is exchanged. Here is what happens in roughly 100 milliseconds:
- Client Hello. Your browser sends a list of supported TLS versions and cipher suites to the server.
- Server Hello. The server selects a TLS version and cipher suite, then sends its certificate.
- Certificate verification. Your browser checks the certificate: Is it signed by a trusted CA? Is it still within its validity period? Does the domain match?
- Key exchange. Browser and server use asymmetric cryptography (the public key in the certificate) to securely exchange a shared symmetric session key.
- Encrypted session begins. All subsequent communication uses the symmetric session key — much faster than asymmetric encryption for bulk data.
Free vs paid SSL certificates
Let's Encrypt, launched in 2016 by the Internet Security Research Group, changed the SSL market permanently by providing free, automatically renewed DV certificates trusted by all major browsers. Today there is no technical or SEO reason to pay for a DV certificate.
Free certificates (Let's Encrypt)
- Domain Validated — issued in seconds
- Auto-renews every 90 days via ACME protocol
- Trusted by all major browsers
- Identical SEO value to paid DV certs
- Supported natively by most hosts
Paid certificates (OV/EV)
- Organisation identity appears in cert details
- Required by some regulated industries
- Typically backed by warranty (rarely relevant)
- Slightly longer issuance time
- Useful for enterprise trust signals
How to install an SSL certificate
For most sites using shared hosting or managed WordPress hosts, SSL is as simple as clicking "Enable HTTPS" in the hosting control panel — the host handles Let's Encrypt provisioning and renewal automatically.
For self-managed servers, the process involves three steps:
- Generate a Certificate Signing Request (CSR). This creates a key pair — a private key (kept on your server) and a CSR you send to the CA.
- Submit the CSR to a CA. For Let's Encrypt, the Certbot tool automates this entire process via the ACME protocol, including domain validation and installation.
- Install the certificate and configure your server. Add the certificate files to your web server config (Apache or Nginx) and enable HTTPS on port 443. Add 301 redirects from HTTP to HTTPS.
Installing an SSL certificate is only step one. You also need to: (1) Add 301 redirects from all HTTP URLs to HTTPS. (2) Update your canonical tags to use HTTPS URLs. (3) Update your sitemap to use HTTPS URLs. (4) Update your Google Search Console property to the HTTPS version. Missing any of these leaves ranking signals split between HTTP and HTTPS versions.
SSL and SEO — the migration checklist
Moving a site from HTTP to HTTPS is a URL migration. Follow these steps to avoid losing rankings:
- Install the SSL certificate and verify all pages load correctly via HTTPS
- Set up 301 redirects from every HTTP URL to its HTTPS equivalent
- Update all internal links to HTTPS
- Update canonical tags to HTTPS
- Update the XML sitemap to HTTPS and resubmit in Search Console
- Add the HTTPS property in Google Search Console (keep the HTTP property too)
- Update social media profile links, Google Business Profile website URL, and any backlinks you control
- Check for mixed content warnings (HTTPS page loading HTTP resources) using browser DevTools
Best practices for SSL certificates in 2026
- Automate renewal. Let's Encrypt certificates expire every 90 days. Use Certbot or your host's auto-renewal to avoid expiry downtime — an expired certificate causes "Your connection is not private" errors for all visitors.
- Use TLS 1.2 and 1.3 only. Disable TLS 1.0 and 1.1, which are deprecated and insecure. Check with SSL Labs' server test to confirm your TLS configuration.
- Enable HSTS. HTTP Strict Transport Security (HSTS) tells browsers to only ever connect via HTTPS and to reject HTTP connections. This prevents SSL stripping attacks and avoids the HTTP-to-HTTPS redirect on repeat visits.
- Test with SSL Labs. Qualys SSL Labs (ssllabs.com/ssltest) gives your site a letter grade (A+ to F) based on certificate validity, TLS version, cipher strength, and HSTS. Aim for A+.
- Secure your wildcard certificates carefully. Wildcard certs (*.domain.com) are convenient but mean a single compromised private key can affect all subdomains. Rotate these regularly.
Frequently asked questions
Not exactly. SSL (Secure Sockets Layer) is the original protocol, now deprecated. TLS (Transport Layer Security) is its modern replacement, with TLS 1.3 being the current standard. In practice, 'SSL certificate' remains the common term even though modern certificates use TLS. When someone says SSL, they almost always mean TLS.
HTTPS (enabled by an SSL/TLS certificate) has been a confirmed Google ranking signal since 2014. The signal is a tiebreaker — when all other factors are equal, HTTPS pages rank above HTTP. More importantly, without HTTPS, Chrome and Firefox display 'Not Secure' warnings that severely damage user trust and conversion rates.
DV (Domain Validated) certificates verify only domain ownership and are issued in minutes. OV (Organisation Validated) certificates verify the organisation behind the domain and take 1-3 days. EV (Extended Validation) certificates require the most rigorous identity check and historically displayed a green address bar, though browsers have largely removed this visual distinction.
Since September 2020, SSL/TLS certificates have a maximum validity period of 398 days (about 13 months). The industry is moving toward shorter lifetimes — Apple's Safari enforces 398 days, and proposals for 90-day or even 47-day maximums are under discussion. Use auto-renewal to avoid expiry.
Yes. Let's Encrypt provides free, automatically renewed DV certificates trusted by all major browsers. Cloudflare also provides free SSL through its CDN. Free certificates are fully valid and suitable for most websites. Paid certificates (OV or EV) add organisational identity verification, which some regulated industries require.
Related glossary terms
Sources
