What is an SSL certificate? TLS, certificate types, and HTTPS in website security

An SSL certificate is a digital document that verifies who owns a domain and enables encryption of the connection between browser and server. A website with a certificate opens at an https:// address; information entered into forms, login passwords, and page content cannot be read or altered in transit. That is the short answer to what an SSL certificate is, but what the certificate does not do matters as much as what it does: an encrypted connection does not close security vulnerabilities on the server.

This guide covers the difference between SSL and TLS, DV, OV, and EV certificate types, whether free certificates are sufficient, validity periods shortening from 2026 onward, mixed content, HSTS, and what HTTPS means to Google. Dates and durations are based on official announcements from the CA/Browser Forum, Let’s Encrypt, Google, and Chrome.

What does an SSL certificate do?

An SSL certificate gives the connection three protections: encryption, integrity, and authentication. Encryption prevents someone on the same network from reading traffic; integrity prevents advertisements, malicious code, or fake links from being added to the page in transit; authentication confirms that the browser is actually communicating with the server belonging to that domain.

The certificate is issued by a certificate authority (CA) trusted by browsers. Before issuing it, the authority verifies that the applicant controls the domain; some certificate types also include verification of company information. On every visit, the browser checks the certificate’s validity period, its match to the domain, and whether it chains to a trusted authority.

Every website with a contact form, member login, quote request, or administration panel needs this protection. Even on a single-page promotional website, a browser warning damages the visitor’s first impression and leaves the connection used to sign in to the administration panel exposed.

What is the difference between SSL and TLS?

TLS is the protocol establishing encrypted connections today; the name “SSL” continues to be used out of habit. The IETF, which sets internet standards, deprecated SSL 3.0 in June 2015 through RFC 7568 and TLS 1.0 and 1.1 in March 2021 through RFC 8996. Current servers operate with TLS 1.2 and TLS 1.3.

Products sold as an “SSL certificate,” “TLS certificate,” or “HTTPS certificate” are the same thing. The certificate itself does not determine the protocol version; which TLS versions are accepted is a server setting. A server still accepting old versions may receive a weak security scan rating despite having a valid certificate.

How do you get an SSL certificate and set up HTTPS step by step?

An HTTPS connection begins with a handshake completed between browser and server in a few milliseconds before page content arrives. The process proceeds roughly in the following order:

  1. The browser connects to the domain and announces its supported TLS versions and encryption methods.
  2. The server selects the method to use and sends its certificate together with intermediate certificates.
  3. The browser checks that the certificate has not expired, covers the domain in the address bar, and forms a chain reaching a root authority it trusts.
  4. The two parties agree on a key that will be valid only for this session.
  5. The page, images, and form data are encrypted and transmitted using this key.

If any check in the third step fails, the browser displays a full-page warning. An expired certificate, a certificate not covering the address with www, or an incompletely installed intermediate certificate are the most common causes of this warning.

The difference between DV, OV, and EV certificate types

SSL certificate types differ in how thoroughly the issuing authority verifies the applicant, rather than in encryption strength. The connection is encrypted with the same strength in all three types; the difference is which information appears as verified within the certificate.

TypeWhat is verified?Issuance speedAppropriate use
DV (domain validated)Only control of the domain (through a DNS record or a file placed on the server)Automatic, within minutesCorporate promotional websites, blogs, and most small business websites
OV (organization validated)The company’s name and existence in addition to the domainMay take days because documents are checkedCorporate policies requiring company information to appear in the certificate
EV (extended validation)The most comprehensive organization verificationThe longest processOrganizations requiring EV under contracts or audits

In the past, EV-certified websites displayed a green company name in the address bar. Chrome removed this indicator from the address bar and moved it to the page information panel with Chrome 77 in 2019; the Chrome team stated that its research found the indicator did not protect users as expected. Consequently, EV does not produce a different trust signal from DV in visitors’ eyes.

Page contents

Trustworthy web agency: handshaking client and team, trust shield illustration

Is a free SSL certificate sufficient?

For the vast majority of corporate promotional websites and blogs, a free DV certificate is technically sufficient. The best-known provider in this area is Let’s Encrypt, a nonprofit certificate authority. According to the Let’s Encrypt FAQ page , the organization charges no fee for certificates, issues DV certificates only, and has no plans to issue OV or EV certificates; some hosting companies may charge a small fee for installation and management.

A paid certificate does not strengthen encryption. Situations making a paid product worthwhile arise when company information must appear as verified in the certificate, when many subdomains need to be combined in one certificate, or when contracted provider support is wanted. The decision is made by defining the need before considering the price.

Let’s review your HTTPS setup together

When the website address is shared through WhatsApp, the certificate type, expiration date, automatic renewal status, redirects, and mixed content warnings are checked together in a free preliminary assessment. Deficiencies and priorities are noted clearly; no ranking or results promises are made.

Why are SSL certificate validity periods getting shorter?

The CA/Browser Forum, the joint rule-setting body of browsers and certificate authorities, adopted decision SC-081 in April 2025 to progressively shorten the maximum validity of publicly trusted TLS certificates. The rationale is to narrow the period during which an incorrectly issued certificate or one with a compromised key can cause harm, and to allow changes in encryption infrastructure to spread faster. The schedule is as follows:

Certificate issuance dateMaximum validity
Before March 15, 2026398 days
March 15, 2026 – March 15, 2027200 days
March 15, 2027 – March 15, 2029100 days
March 15, 2029 and later47 days

Let’s Encrypt certificates are already issued for 90 days. According to the organization’s December 2025 announcement, 45-day certificates have been available through an optional profile since May 13, 2026; the default period drops to 64 days on February 10, 2027, and to 45 days on February 16, 2028. Let’s Encrypt discourages manual renewal and recommends setting up monitoring for cases where renewal does not occur.

The practical consequence is clear: the era of renewing a certificate by noting it in the calendar once a year is over. Automatic renewal must be enabled in the hosting dashboard, the domain’s DNS records must permit verification, and the expiration date must be tracked with a monitoring tool. Automatic renewal can silently stop when DNS moves to another provider or a CDN is introduced; renewal errors are most often seen after changes of this kind.

Does HTTPS affect Google rankings?

HTTPS is among Google’s ranking signals, but it is a lightweight signal. In its 2014 HTTPS announcement , Google described this signal as “very lightweight” and stated that it carries less weight than signals such as high-quality content. The current page experience document also lists whether a page is served over HTTPS among the points website owners should check and directs them to the HTTPS report in Search Console.

A certificate alone does not move a page to the top of the rankings; a page with weak content does not move ahead merely because it uses HTTPS. The main impact is on users. With Chrome 68 in July 2018, Chrome began marking all HTTP pages as “Not secure” in the address bar. According to Google’s October 2025 announcement, the “Always use secure connections” setting will be enabled by default with Chrome 154 in October 2026; the browser will request confirmation before a user’s first visit to a public website that does not offer HTTPS.

For SEO, implementing the transition to HTTPS properly matters more than the certificate itself. HTTP addresses must be sent to their HTTPS equivalents through permanent (301) redirects, and HTTPS addresses must be used in the sitemap and canonical tags. These steps are fundamental parts of technical SEO checks.

Transparent pricing: calculator and budget planning illustration

What is mixed content, and how is it fixed?

Mixed content occurs when a page opened over HTTPS still requests some files from an http:// address. According to the MDN documentation , browsers attempt to automatically upgrade upgradable content such as images, video, and audio to HTTPS; they do not load blockable content such as scripts, stylesheets, and iframes. The result is often a broken menu, a form that does not work, or a missing map.

On WordPress websites, mixed content usually comes from records left over from the HTTP period. The following points are checked during cleanup:

  • The WordPress Address and Site Address fields on the Settings page begin with https://
  • Old http:// links are updated in database records for posts, pages, and page builders
  • Absolute addresses manually written into theme files, custom CSS, or menus
  • Font, map, video, and counter codes requested from external services
  • A single-step permanent redirect from HTTP to HTTPS at the server level

The Console tab in the browser’s developer tools lists mixed content warnings with file names. If the page cache is not cleared after corrections, old addresses may continue to be served to visitors.

What is HSTS, and when should it be enabled?

HSTS (HTTP Strict Transport Security) is a response header through which the server tells the browser, “connect to this domain only through HTTPS for a specified period.” Once a browser receives the header, it converts requests directly to HTTPS even if the visitor types http:// in the address bar. This reduces the risk of the initial HTTP request being redirected by an intermediary.

The header’s max-age value determines how many seconds the rule remains valid, while includeSubDomains determines whether subdomains are covered too. To enter the preload list built into browsers, max-age must be at least one year and includeSubDomains must be present. hstspreload.org recommends starting with a few minutes and gradually increasing the duration, and warns that removal from the list is slow and difficult.

For this reason, HSTS is enabled after verifying that all subdomains (email interfaces, old campaign pages, and internal dashboards) work properly over HTTPS. A long-duration rule added hastily can leave a subdomain without a certificate inaccessible for months.

Does an SSL certificate protect a website from hacking?

It does not. An SSL certificate prevents data from being read or altered in transit; it is not a shield against attacks on the server or software. A vulnerability in an outdated plugin, a predictable administrator password, or incorrect file permissions can also be exploited on a website with a flawless certificate.

The padlock icon in the address bar was also misunderstood for a long time. According to the Chrome team’s 2023 explanation, the icon indicates only that the connection is secure, not that the website is trustworthy; almost all phishing websites also use HTTPS. Chrome therefore replaced the padlock with a neutral settings icon in Chrome 117, released in September 2023. Risks HTTPS does not address include:

  • Known security vulnerabilities in WordPress core, themes, and plugins
  • Brute-force login attempts using weak or reused passwords
  • Malicious files and backdoors uploaded to the server
  • Malware on the administrator’s computer
  • Data loss on websites without backups

These layers are protected through regular updates, permission management, and backups; WordPress maintenance and updates cover this work. If an attack has occurred, renewing the certificate does not solve the problem; recovering a hacked WordPress website requires a separate cleanup process.

Common SSL installation mistakes and the correct approach

Most SSL problems arise from incomplete steps after installation rather than obtaining the certificate. The most frequently encountered situations in practice and the correct approaches can be summarized as follows.

The certificate covers only one address format: if the domain opens both with and without www, the certificate must cover both, and one address must redirect to the other.

Leaving renewal unattended: verify that automatic renewal works by monitoring the certificate expiration date. As validity periods shorten, an unnoticed renewal error is increasingly likely to take the website offline.

Redirect chains: if http://alanadi.com first goes to the www address and then to HTTPS, two separate redirects occur. Going to the final address in one step is cleaner for both speed and crawling.

Forgetting the certificate when changing hosting: the certificate must also be installed again when the website moves to a new server. When choosing hosting , ask from the outset whether free certificate support and automatic renewal are available.

Let’s look at your certificate and HTTPS status together

Beyond asking what an SSL certificate is, a brief check is enough to see what is missing on a website. The certificate expiration date, redirects, mixed content, and security layers are examined together in a free preliminary assessment; the required actions are shared in priority order.

Related guides

Frequently asked questions

An SSL certificate is a digital document that verifies domain ownership and enables encryption of the connection between browser and server. Websites with certificates open over https://, and transferred data cannot be read in transit.

In everyday usage, they describe the same product; TLS is the protocol establishing the connection today, and SSL versions have been deprecated. The name “SSL certificate” persists out of habit.

Yes, free DV certificates such as Let’s Encrypt provide encryption of the same strength as paid certificates. The difference lies in whether company information is verified and the scope of support, rather than encryption.

Under CA/Browser Forum rules, certificates issued from March 15, 2026 onward are valid for a maximum of 200 days; this drops to 100 days on March 15, 2027, and to 47 days on March 15, 2029. Let’s Encrypt certificates default to 90 days.

HTTPS is a lightweight Google ranking signal and does not replace content quality. The main impact comes from preventing browser warnings and implementing the HTTPS transition with correct redirects.

Browsers display a full-page security warning before opening the website, and most visitors cannot reach the page. Keeping automatic renewal enabled and monitoring the expiration date prevents this situation.

Yes, the certificate protects only data in transit; it does not prevent attacks exploiting outdated plugins, weak passwords, or server vulnerabilities. Security also requires updates, permission management, and backups.

Onur Ertem - Onur Freelance Corporate Web Design

Onur Ertem

Strengthen your business online! 🚀 Are you ready to grow your brand with corporate web design and digital marketing solutions? Contact us now and stand out in the digital world with our professional support!

Phone-alt Whatsapp

Call us

Call us for detailed information.

Let us call you!

Share your phone number and let us call you!

Our other services

Service areas

Contact information