An SSL certificate is a digital file installed on a web server that does two things. It lets a browser confirm that it is talking to the genuine website for that domain, and it enables an encrypted connection between the two. When the certificate is valid, the address bar shows https:// and a lock icon, and information such as passwords, form entries and payment details is scrambled while it travels across the internet.
SSL, TLS and HTTPS: Untangling the Terms
"SSL" is the name most people still use, but the original Secure Sockets Layer protocol has been replaced by Transport Layer Security (TLS), which is what browsers and servers actually use today. Certificates sold as SSL certificates work with TLS. HTTPS is simply the normal HTTP web protocol running on top of that encrypted connection.
How the Browser Decides to Trust a Site
A certificate contains the domain name, the organisation that holds it where applicable, a validity period and a public key. It is signed by a certificate authority (CA), an organisation that browsers already trust. When a visitor connects, the browser checks the signature, the domain match and the expiry date. If anything is wrong, it shows a full-page warning, and many visitors leave rather than proceed. If everything checks out, keys are exchanged and the session is encrypted.
Certificate Types
Certificates differ in how much checking the authority performs and in how many domains they cover:
- Domain Validated (DV) confirms control of the domain only and is usually issued quickly and automatically
- Organization Validated (OV) also verifies the business behind the domain
- Extended Validation (EV) applies a stricter identity check, although modern browsers no longer give it special prominence
- Wildcard certificates cover a domain and all of its subdomains
- Multi-domain (SAN) certificates cover several different domain names at once
Encryption itself works the same way across these types. The difference lies in the identity assurance, not in how the data is protected.
Installation and Ongoing Care
Installing a certificate is only part of the job. Certificates have an expiry date, so renewal needs to be automated or tracked, because an expired certificate triggers browser warnings immediately. After installation, the site should redirect every http:// address to https:// with a permanent redirect, and internal links, canonical tags and the XML sitemap should be updated. Mixed content also needs fixing: images or scripts still loaded over plain HTTP cause browsers to flag the page as not fully secure.
Security and Search Visibility
HTTPS is expected on any page that collects personal data, and payment providers require it. Google has described HTTPS as a lightweight ranking signal, so it is better seen as a baseline than as a shortcut to higher rankings. Its more practical effect is trust: visitors are less likely to complete a form on a page their browser labels "Not secure".
A certificate is issued for a specific domain name and installed on the server that provides your web hosting, often with help from the host. If you need help moving a site to HTTPS, you can speak to our website development team.