What is an SSL Certificate? HTTPS for SEO

An SSL certificate is a small digital file that proves a website is who it claims to be and provides the public key browsers use to establish an encrypted connection with it. It's what makes HTTPS possible, the padlock, the encrypted traffic, all of it hangs off the certificate. A trusted third party called a certificate authority (CA) issues it after verifying you control the domain.

Pedantic but useful naming note up front. SSL, the protocol, is dead, its successor TLS has handled the actual encryption for many years. The certificates work with TLS, and "TLS certificate" is the technically correct term. The industry just never stopped saying SSL, so both names refer to the same file. You'll buy an "SSL certificate" and your server will speak TLS with it, and everyone involved has made peace with this.

What a Certificate Actually Does

Two jobs, identity and key exchange.

Identity. The certificate binds a domain name to a cryptographic key pair, signed by a CA that browsers already trust. When your browser connects to a site, the site presents its certificate, and the browser checks the signature chain back to a trusted root. This is what stops an attacker on the network from simply impersonating your bank, they can intercept traffic, but they can't present a valid certificate for a domain they don't control.

Key exchange. The certificate's public key bootstraps the TLS handshake, where browser and server agree on session keys. Everything after that, URLs, form data, cookies, passwords, travels encrypted.

Worth being precise about the limit too. The padlock means the connection is encrypted and the domain is verified. It says nothing about the site being honest, phishing sites run HTTPS routinely, because certificates are trivially obtainable for any domain you control, including convincingly misspelled ones.

Certificate Types, and Which One You Need

• Domain Validated (DV). Proves domain control, issued in minutes, free from Let's Encrypt. This is what nearly every site needs, this one included.
• Organization Validated (OV) and Extended Validation (EV). The CA additionally verifies the legal entity behind the domain. Enterprises and finance buy them for compliance and internal-policy reasons. Browsers stopped displaying EV company names in the address bar years ago, which removed most of the visible point.
• Wildcard certificates cover *.example.com, every subdomain with one file. Multi-domain (SAN) certificates cover a list of unrelated names.

The pricing conversation aged badly, in a good way. Let's Encrypt, launched in the mid-2010s, issues free 90-day DV certificates with automated renewal, and most hosting platforms now provision them without you thinking about it. Paying for a basic DV certificate in 2026 mostly means your hosting setup predates automation, and I can't remember the last time I saw a good reason to.

Why HTTPS Matters for SEO

Google announced HTTPS as a ranking signal back in 2014, explicitly calling it lightweight at the time. The direct boost is small. The indirect stack is not:

• Browsers mark HTTP as "Not secure." Chrome started labeling all plain HTTP pages that way in 2018. Users notice, and a warning label on a checkout page costs real conversions.
• Referral data survives. HTTPS-to-HTTP navigation strips the referrer, so an HTTP site sees its referral traffic mislabeled as direct.
• Modern web features require it. HTTP/2 in practice, service workers, geolocation, most powerful browser APIs are HTTPS-only.
• Trust compounds. Page experience, conversions, willingness to enter an email. None of it works on a page the browser is actively warning about.

In 2026 the real SEO issue isn't whether to use HTTPS, that argument ended years ago. It's misconfiguration, which quietly burns sites that technically have certificates.

The Mistakes That Actually Break Things

1. Expired certificates. The classic. The site goes down behind a full-screen browser warning until someone renews. Automate renewal, Let's Encrypt's whole design assumes it, and monitor expiry anyway, since automation fails silently about once per company per career.

Checking Your Setup

Fast version, visit the site with http://, https://, with and without www, and confirm all four land on one canonical HTTPS URL in a single redirect. Then click through a few templates looking for mixed-content warnings in the console. Certificate details, expiry, chain, protocol versions, are one click away in any browser's padlock menu, and free scanners like SSL Labs grade the full server configuration if you want the deep report. The whole check takes five minutes and finds embarrassing things more often than you'd expect. I say that from experience, it was our audit finding too.

Related Terms

• What is HTTPS? - the protocol layer the certificate enables.
• What is a 301 Redirect? - the mechanism that consolidates HTTP onto HTTPS.
• What are HTTP Status Codes? - the response vocabulary redirects live in.
• What is Technical SEO? - the discipline certificate hygiene belongs to.
• What is a CDN? - where TLS termination often actually happens on modern stacks.

Key Takeaways

• An SSL (really TLS) certificate proves domain identity and enables the encrypted HTTPS connection.
• Free automated DV certificates cover nearly every site; paid tiers exist for organizational validation, not better encryption.
• HTTPS is a small direct ranking signal wrapped in large indirect effects, browser warnings, referrer data, feature access.
• The live risks are expiry, missing HTTP-to-HTTPS redirects, mixed content, and uncovered hostname variants, all cheap to check.

Sources

• HTTPS as a Ranking Signal - Google Search Central Blog (checked 2026-08-12)
• Let's Encrypt Documentation (checked 2026-08-12)
• Transport Layer Security - MDN (checked 2026-08-12)