What is an SSL certificate?
What the certificate does, why HTTPS is a real but lightweight ranking signal, and the mixed-content, expiry and hostname traps that break the padlock.
An SSL certificate is a small data file that lets a website prove its identity and encrypt the connection between it and a visitor’s browser. It is what turns http:// into https:// and puts the padlock in the address bar. Every serious site needs one — not mainly for SEO, but because browsers now actively warn people away from sites that lack it.
SSL, TLS, HTTPS: which word is which
The terminology is a small mess of history. SSL (Secure Sockets Layer) is the original protocol; it is obsolete and every version of it has been deprecated. Its successor is TLS (Transport Layer Security), which is what actually secures connections today. But the name “SSL certificate” stuck, so what everyone calls an SSL certificate is really a TLS certificate. HTTPS is simply HTTP running over that secured TLS connection. In practice you can treat “get an SSL certificate” and “enable HTTPS” as the same task.
What it actually does
A certificate provides three things. Encryption: data moving between the browser and the server is scrambled, so anyone intercepting it — on public Wi-Fi, say — sees nothing usable. Integrity: the data cannot be tampered with in transit without detection. Authentication: the certificate, issued by a trusted authority, proves the site is who it claims to be and not an impostor. The padlock in the browser is the visible shorthand for all three.
Why it matters for SEO
Google confirmed HTTPS as a ranking signal back in 2014, and it remains one — but it has always described the weight as light, a tie-breaker between otherwise equal results rather than a lever that moves a page on its own. So the honest framing is that HTTPS is necessary, not powerful: you need it to avoid a disadvantage, but adding it will not by itself raise a page that is struggling for other reasons.
The larger effect is indirect. Chrome and other browsers mark any http:// page “Not secure”, and pages that collect form input without HTTPS get a more prominent warning. That warning drives visitors away and undermines trust, which hurts the engagement and conversions that do influence how a site performs. The certificate protects your reach more than your ranking.
The problems that actually bite
Mixed content. The page loads over HTTPS but pulls in some resources — an image, a script, a stylesheet — over http://. Browsers block or warn on this, and it is the most common reason a padlock fails to appear after a migration. Every resource must be served over HTTPS.
An expired certificate. Certificates have an expiry date, and a lapsed one throws a full-page browser warning that stops visitors at the door. Automated renewal — which free certificates from Let’s Encrypt provide — is the standard defense, because manual renewal is the kind of task that gets forgotten exactly once.
A hostname mismatch. A certificate issued for example.com but not www.example.com (or the reverse) triggers a warning on the uncovered hostname. The certificate has to cover every hostname the site actually answers on.
Not redirecting HTTP to HTTPS. Installing a certificate does not remove the http:// version — both keep serving, which is duplicate content and leaves the insecure version reachable. Complete the job with a site-wide 301 redirect from http to https so there is one canonical, secure origin.
Do you need to pay for one?
For most sites, no. Free certificates from authorities like Let’s Encrypt provide exactly the same encryption and browser trust as paid ones, and most hosts issue and auto-renew them for you at no cost. Paid certificates mainly add organizational identity validation and warranties that matter to large enterprises and e-commerce operations; the padlock and the security are identical either way.
How to check yours
Our SSL certificate checker inspects a site’s certificate and reports whether it is valid, when it expires, and whether it covers the hostname you are checking — so you catch an approaching expiry or a mismatch before your visitors do. The HTTP header checker confirms whether http:// requests are being redirected to https:// as they should be. To check your certificate alongside the rest of your technical setup, run a full site check.
Frequently asked questions
- What is an SSL certificate?
- An SSL certificate is a data file that lets a website prove its identity and encrypt the connection between the server and a visitor's browser. It is what enables HTTPS and shows the padlock in the address bar. Despite the name, modern certificates use the TLS protocol rather than the obsolete SSL, but the term 'SSL certificate' has stuck.
- Does an SSL certificate help SEO?
- Yes, but only lightly. Google confirmed HTTPS as a ranking signal in 2014 and describes its weight as small — a tie-breaker rather than a lever that lifts a page on its own. The bigger effect is indirect: without a valid certificate, browsers mark your site 'Not secure', which drives visitors away and undermines the trust and engagement that do affect performance.
- What is the difference between SSL and TLS?
- SSL (Secure Sockets Layer) is the original protocol and is now obsolete, with every version deprecated. TLS (Transport Layer Security) is its successor and is what actually secures connections today. The name 'SSL certificate' persisted for familiarity, so what people call an SSL certificate is really a TLS certificate. For practical purposes the terms are used interchangeably.
- What is mixed content?
- Mixed content is when a page served over HTTPS loads some resources — an image, script, or stylesheet — over insecure HTTP. Browsers block or warn on it, and it is the most common reason the padlock fails to appear after moving a site to HTTPS. The fix is to ensure every resource on the page is served over HTTPS, not just the page itself.
- Do I need to pay for an SSL certificate?
- For most sites, no. Free certificates from authorities like Let's Encrypt provide the same encryption and browser trust as paid ones, and most hosts issue and auto-renew them at no cost. Paid certificates mainly add organizational identity validation and warranties relevant to large enterprises and e-commerce; the security and the padlock are identical either way.
- Do I still need to redirect HTTP to HTTPS after installing a certificate?
- Yes. Installing a certificate does not remove the http version of your site — both keep serving, which creates duplicate content and leaves an insecure version reachable. Add a site-wide 301 redirect from http to https so every request lands on the secure version and you have a single canonical origin. Without it, the certificate is installed but not fully doing its job.