An SSL certificate is a small data file installed on a web server. It proves the site’s identity and switches on encrypted HTTPS connections between the site and each visitor’s browser. Without one, passwords, card numbers and form entries travel as readable text, Chrome marks the page “Not secure”, and you give up a confirmed Google ranking signal.
This guide covers how an SSL certificate works, the seven reasons it matters, current 2026 adoption statistics, certificate types, the padlock myth and the new 200-day renewal limit. It ends with install steps, an error-fix table and an FAQ.
Key Takeaways
- An SSL certificate proves your domain’s identity and lets browsers open an encrypted HTTPS connection to your site.
- Chrome has labelled every plain HTTP page “Not secure” since July 2018, and Google has used HTTPS as a ranking signal since 2014.
- The padlock proves encryption and domain control. It does not prove the site is trustworthy, and most phishing sites now carry one.
- Since 15 March 2026, new public certificates last at most 200 days. The cap falls to 47 days in 2029, so automatic renewal is now a requirement.
- A free domain validation (DV) certificate is enough for most blogs, stores and company sites. Choose OV or EV only when you need documented identity checks.
How Does an SSL Certificate Work?
An SSL certificate works by letting a browser verify who runs a server, then agree on a secret key that only the two of them know. The process is called the TLS handshake, and it finishes in milliseconds before the page starts to load.
- The browser connects to your server on port 443 and lists the encryption versions and ciphers it supports.
- The server replies with its SSL certificate, which includes its public key.
- The browser checks that a trusted certificate authority (CA) signed the certificate, that the domain name matches, and that the dates are still valid.
- Both sides use the public key to agree on a shared session key. TLS 1.3 uses an ephemeral key exchange, so recorded sessions stay unreadable even if the server key leaks later.
- All further traffic is encrypted with the session key. Anyone watching the network sees scrambled data.
The private key never leaves your server. The certificate is public by design and is useless to an attacker without that private key.
Your web host usually installs and renews the certificate for you. If you are new to how servers and plans fit together, start with our guide to what web hosting is and how it works.
SSL vs TLS vs HTTPS: What Is the Difference?
People say “SSL certificate” out of habit, but the protocol running today is TLS. SSL 3.0 was formally prohibited in 2015, and TLS 1.0 and 1.1 were deprecated in 2021.
| Term | What it is | Status in 2026 |
|---|---|---|
| SSL | The original encryption protocol from the 1990s | Retired, never enable it |
| TLS | SSL’s successor, in versions 1.2 and 1.3 | Current standard, with TLS 1.3 preferred |
| HTTPS | HTTP running inside a TLS connection | What visitors see in the address bar |
| SSL/TLS certificate | The file that proves identity and carries the public key | Issued by a certificate authority |
This guide uses “SSL certificate” because that is the term people search for. Technically, the file on your server is a TLS certificate, and it works the same way. Our website builder glossary defines 60+ more terms like these.
What Does an SSL Certificate Contain?
An SSL certificate is an X.509 file with a short, fixed set of fields. Click the padlock in your browser and open the certificate details to see them:
- The domain names it covers (Common Name and Subject Alternative Names)
- The organization name and country, for OV and EV certificates only
- The issuing certificate authority
- The valid-from and valid-to dates
- The public key and its algorithm, usually RSA or ECDSA
- The CA’s digital signature, which browsers verify
- The serial number and fingerprint
Why Is an SSL Certificate Important? 7 Reasons
An SSL certificate protects visitors, supports your search visibility and removes the browser warnings that interrupt a visit. Each reason below comes with the evidence behind it.
1. It encrypts data between your visitor and your server
Without encryption, anyone on the same Wi-Fi network, at the internet provider or along the route can read or alter the traffic. That includes login forms, contact form entries, cookies and card details. With HTTPS the data is scrambled and tampering is detected. A third party also cannot inject ads or malware into your pages in transit.
This is why even a site that sells nothing needs HTTPS. A login box or a contact form is enough to put visitor data at risk.
2. It proves the domain is the one the visitor meant to reach
A CA must confirm you control the domain before it issues the certificate. A browser then refuses to connect if the certificate does not match the address. That blocks man-in-the-middle attacks, where an attacker poses as your server on a public network. OV and EV certificates add checked company details on top.
3. It prevents “Not secure” warnings
Chrome 56 (January 2017) began flagging HTTP pages that collect passwords or card numbers. Chrome 68 (July 2018) marked every HTTP page as “Not secure”, as laid out in Cloudflare’s timeline of the change. An expired or misconfigured certificate is worse: the browser shows a full-page warning that gives visitors a reason to leave.
4. It supports your SEO
Google announced in August 2014 that HTTPS counts as a ranking signal. It began as a minor signal that works like a tie-breaker between similar pages. An SSL certificate will not lift a weak page to position one. It removes a small disadvantage and supports the trust and speed signals that matter more.
There is a measurement benefit too. When a visitor arrives from a secure site to an HTTP site, the referrer data is stripped, so analytics may report that visit as direct traffic.
5. It unlocks modern, faster web protocols
Browsers support HTTP/2 and HTTP/3 only over encrypted connections, and HTTP/3 builds TLS 1.3 into its transport layer. Multiplexed requests and faster connection setup are therefore available to HTTPS sites only. Newer browser features such as service workers and geolocation also require a secure context.
6. It helps you meet payment and privacy rules
PCI DSS requires strong cryptography when cardholder data crosses open, public networks. GDPR Article 32 expects appropriate technical measures such as encryption. An SSL certificate covers the in-transit part of both. Compliance also depends on how you store data and who can access it, so confirm the exact requirements with your compliance lead.
7. It builds trust and removes an easy path to a breach
The padlock is the security signal most visitors recognize, and its absence is the first thing a cautious shopper notices. The stakes are real: IBM’s 2025 Cost of a Data Breach Report puts the global average cost of a breach at $4.44 million, the US average at $10.22 million, and the time to identify and contain a breach at 241 days.
An SSL certificate does not stop every breach, because many start with stolen credentials or unpatched software. It does close one of the easiest routes: reading data as it crosses the network.
SSL Certificate Statistics for 2026
Published adoption figures disagree because each source counts something different: websites, page loads or requests. The table shows what each number actually measures.
| Statistic | Figure | What it measures | Source |
|---|---|---|---|
| Websites using HTTPS by default | 86.9% (January 2026) | Share of scanned websites, from W3Techs | SSL Insights |
| Websites with a valid certificate | About 90% (April 2026) | Estimate of roughly 1.2 billion sites, leaving about 120 million without | HostingAdvice |
| Human web traffic over HTTPS | 98.6% in 2026, up from 98.03% | Cloudflare Radar requests from people. Blended with bots the figure is 94.59% | Technology Checker |
| Top-ranked sites using HTTPS | 98% or more | Scan of 1.6 million ranked domains, April 2026 | Statvoo |
| Top 10,000 sites on TLS 1.3 | 86%, up from 62% in 2023 | Share of the top 10,000 websites | Statvoo |
| Top 1,000 sites sending HSTS | About 78% | Sites that force browsers onto HTTPS | Statvoo |
| Certificates issued by Let’s Encrypt | 51.5% | Certificates logged between 14 February and 16 March 2026 | Technology Checker |
| Phishing sites using HTTPS | Over 90% | APWG phishing reports | SSL Insights |
Two caveats apply. HostingAdvice notes that many sites without a certificate are old, abandoned or poorly maintained. And the 98.6% figure counts requests, not websites. For most site owners the question is no longer whether to use HTTPS but whether the setup is correct. Our web hosting statistics roundup tracks market share and trends alongside these security figures.
Types of SSL Certificates
Certificates are classified two ways: by how much the CA checks about you, and by how many names they cover. Encryption strength is the same in every type.
By validation level
| Type | What the CA verifies | Typical issue time | Best for |
|---|---|---|---|
| Domain Validation (DV) | Control of the domain only | Minutes, automated | Blogs, portfolios, most stores and SaaS sites |
| Organization Validation (OV) | Domain control plus the registered organization | One to three days | Company sites, B2B portals, membership sites |
| Extended Validation (EV) | Legal, physical and operational existence | Several days | Banks, regulated firms, high-risk brands |
DV certificates make up 94.3% of all certificates according to SSL Insights, largely because Let’s Encrypt issues them free. Current Chrome and Firefox no longer show the green company-name bar for EV, so its benefit is documented identity inside the certificate details rather than a visible badge.
By coverage
| Type | Covers | Watch out for |
|---|---|---|
| Single-domain | One hostname, such as www.example.com | Add the bare domain as a second name |
| Wildcard | A domain and all its first-level subdomains, such as *.example.com | It does not cover a.b.example.com, and wildcards from Let’s Encrypt need DNS validation |
| Multi-domain (SAN or UCC) | Several different domains in one certificate | Adding a name means reissuing the certificate |
The Padlock Myth: HTTPS Does Not Mean a Site Is Safe
An SSL certificate verifies the connection and the domain, not the intentions of the person running the site. Free DV certificates are issued automatically to anyone who controls a domain, criminals included. That is why over 90% of phishing sites now use HTTPS, according to the APWG data summarized above.
For visitors, the useful habit is to read the domain name carefully instead of trusting the padlock. For site owners, HTTPS is the baseline, and it needs company.
| An SSL certificate does | An SSL certificate does not |
|---|---|
| Encrypt data in transit | Scan your site for malware |
| Confirm the domain’s identity (and the organization, for OV and EV) | Fix outdated plugins or weak passwords |
| Detect tampering between browser and server | Block brute-force logins, SQL injection or DDoS traffic |
| Enable HTTP/2 and HTTP/3 | Protect data stored on your server |
Add security headers such as HSTS and a Content Security Policy, keep software updated, run regular backups and put a firewall in front of the site. Statvoo’s scan found HSTS on about 78% of the top 1,000 sites and a Content Security Policy on about 62% of its ranked domains, so many sites stop at the certificate.
SSL Certificates Now Expire Every 200 Days (and Every 47 Days by 2029)
Most guides still say an SSL certificate lasts a year. That changed on 15 March 2026. The CA/Browser Forum approved Ballot SC-081v3 on 11 April 2025, which cuts the maximum validity of publicly trusted certificates in three steps. DigiCert’s FAQ and InfoQ’s report both confirm the schedule.
| Certificates issued from | Maximum validity | Typical renewal rhythm |
|---|---|---|
| Before 15 March 2026 | 398 days | About once a year |
| 15 March 2026 (in effect now) | 200 days | About twice a year |
| 15 March 2027 | 100 days | About every quarter |
| 15 March 2029 | 47 days | Every six to seven weeks |
The period during which a CA may reuse a domain validation result also shrinks, from 398 days to 10 days by 2029. Some providers set their own limit one day lower: DigiCert caps its certificates at 199 days to stay inside the rule.
Let’s Encrypt certificates already last 90 days, so the 2026 change does not affect them, as DNSimple’s announcement explains. Paid certificates are still often billed yearly but must now be reissued mid-term, as DonDominio describes.
What to do about it:
- Turn on automatic renewal through your host, an ACME client or your CA’s own automation.
- Confirm whether your host reissues and installs the certificate for you, or whether that step is manual.
- Set expiry alerts at 30 and 14 days before the end date.
- List every certificate you own, including subdomains, staging sites and mail servers.
- On a self-managed server, schedule the renewal command and test it with a dry run.
How to Choose the Right SSL Certificate
Paid certificates buy organization checks, warranties and support. They do not buy stronger encryption. Match the certificate to the job:
- Blog, portfolio or small business site: a free DV certificate from your host or Let’s Encrypt.
- Online store using a hosted payment page: DV is technically enough, because the payment provider handles card data.
- Company portal, B2B site or membership area: OV, so the certificate details show your registered organization.
- Many subdomains: a wildcard certificate.
- Several unrelated domains: a multi-domain certificate.
- A compliance rule or partner that demands EV: EV, and nothing else.
Whether SSL is free or paid is part of choosing a host. See our ranking of the best web hosting providers, or the best cheap hosting providers if budget decides.
How to Get and Install an SSL Certificate
How much work this takes depends on where your site is hosted.
| Hosting setup | How you get the SSL certificate | Effort |
|---|---|---|
| Website builder | Included and switched on by default | None |
| Managed WordPress hosting | Issued and renewed by the host | Very low |
| Shared hosting with a control panel | One click, or automatic (AutoSSL on cPanel) | Low |
| CDN in front of the site | Edge certificate from the CDN, plus a valid certificate on the origin server | Low |
| VPS or dedicated server | Install an ACME client such as Certbot and configure the web server | Medium |
Not sure which plan type you have? Our guide to managed hosting vs shared hosting explains who handles what. On control-panel hosts, our complete cPanel guide covers the panel where AutoSSL lives. Running your own server? Compare options in our list of the best VPS hosting providers.
Manual installation steps
- Confirm your domain points at the right server. The DNS checker tool shows the current A and AAAA records, and DV validation fails if they are wrong.
- Generate a private key and a certificate signing request (CSR), or let your ACME client do it.
- Pick a CA and a validation method: a file on your site (HTTP-01), a DNS TXT record (DNS-01, required for wildcards) or email.
- Install the certificate and the intermediate chain on your web server.
- Redirect all HTTP traffic to HTTPS with a 301 redirect.
- Test the result and set up automatic renewal.
For a free certificate, follow the Let’s Encrypt getting started guide and use Certbot, which handles issuance and renewal.
After installing on WordPress
- In Settings, then General, change the WordPress Address and Site Address to https.
- Add a site-wide 301 redirect from HTTP to HTTPS in your host panel or .htaccess file.
- Fix mixed content. Take a backup, then preview the change with WP-CLI:
wp search-replace 'http://example.com' 'https://example.com' --all-tables --dry-run- Run the same command without –dry-run once the preview looks right.
- Add the HTTPS version as a property in Google Search Console, submit the sitemap again and update the default URL in your analytics tool.
- Add the HSTS header only after every page loads cleanly over HTTPS, and start with a short max-age.
Common SSL Certificate Errors and How to Fix Them
| Browser message | Likely cause | Fix |
|---|---|---|
| ERR_CERT_DATE_INVALID | The certificate expired, or the visitor’s device clock is wrong | Renew and reinstall the certificate, then check that auto-renewal works |
| ERR_CERT_COMMON_NAME_INVALID | The certificate does not cover the hostname, for example www versus the bare domain | Reissue it with every name you serve |
| ERR_CERT_AUTHORITY_INVALID | A self-signed certificate, or a missing intermediate certificate | Install the full chain supplied by the CA |
| Mixed content warning | The page loads images, scripts or CSS over http:// | Change those URLs to https://, using a search-and-replace for hard-coded links |
| ERR_TOO_MANY_REDIRECTS | A redirect loop, often a CDN in “Flexible” SSL mode combined with a server-side HTTPS redirect | Set the CDN to full strict mode and keep one redirect rule |
| ERR_SSL_PROTOCOL_ERROR | The server offers only retired protocols, or no HTTPS on port 443 | Enable TLS 1.2 and 1.3 and check the virtual host configuration |
How to Check Your SSL Certificate
Click the padlock or site-information icon in your browser, then open the certificate details. For a faster read, paste your domain into our free SSL checker, which shows the issuer and the expiry date.
Check four things: the expiry date, that the certificate covers both www and the bare domain, that the full chain is installed, and that the server accepts TLS 1.2 or newer. Run the check after every renewal and after any CDN change.
Frequently Asked Questions About SSL Certificates
What is an SSL certificate in simple terms?
An SSL certificate is a digital file on a web server that proves the site’s identity and enables encrypted HTTPS connections, so data sent between a visitor and the site cannot be read or changed in transit.
Is an SSL certificate necessary for every website?
Yes. Every public website should use HTTPS, even without a login or checkout. Chrome labels HTTP pages “Not secure”, Google uses HTTPS as a ranking signal, and an HTTP page can be altered in transit to inject ads or malware.
Does an SSL certificate improve SEO?
Slightly. Google has used HTTPS as a minor ranking signal since 2014. The larger benefit is indirect: no browser warnings, more visitor trust, intact referral data and access to HTTP/2 and HTTP/3.
How long is an SSL certificate valid?
Publicly trusted certificates issued on or after 15 March 2026 are valid for at most 200 days. The limit falls to 100 days in March 2027 and 47 days in March 2029. Let’s Encrypt certificates already last 90 days.
Is a free SSL certificate as secure as a paid one?
For encryption, yes. Free DV certificates from Let’s Encrypt use the same TLS protocols and key strengths as paid ones. Paid certificates add organization validation, warranties and support.
What happens when an SSL certificate expires?
Browsers show a full-page security warning and block the normal connection until the certificate is renewed. Crawlers and APIs that connect over HTTPS can also fail, so an expired certificate can cost traffic and sales.
What is the difference between SSL and TLS?
TLS is the modern successor to SSL. All SSL versions are retired, and current sites use TLS 1.2 or 1.3. People still say “SSL certificate” out of habit, and the certificate file itself is the same.
SSL Certificate Checklist for 2026
- Every page loads over HTTPS, and HTTP redirects with a 301
- The certificate covers www and the bare domain
- Automatic renewal is on and has been tested
- Expiry alerts are set at 30 and 14 days
- No mixed content warnings in the browser console
- TLS 1.2 and 1.3 are enabled, and old protocols are off
- HSTS is added after a full HTTPS test
An SSL certificate takes minutes to install and, with automatic renewal, almost no upkeep. The sites that run into trouble are the ones where nobody owns the renewal. Assign that job, test it once, and run the check again after every hosting or CDN change.
