SSL certificates encrypt the connection between your site and its visitors, protecting passwords, payment data, and personal details from interception. Google has used HTTPS as a ranking signal since 2014. Today, nearly every site worth visiting runs on HTTPS.
But SSL isn't just theory. Expired or misconfigured certificates cause full-page browser warnings that kill conversions within hours. I've seen this happen to sites that had working auto-renewal — until the renewal silently failed.
What Is an SSL Certificate?
An SSL (Secure Sockets Layer) certificate — technically TLS (Transport Layer Security) in modern implementations — is a digital certificate that does three things:
- Authenticates your website's identity (proves you are who you say you are)
- Encrypts all data transmitted between the server and browser
- Enables HTTPS — the padlock icon in browser address bars
Types of SSL Certificates
By Validation Level
- DV (Domain Validation) — Confirms you control the domain. Issued automatically in minutes. Free with Let's Encrypt. Sufficient for most websites, blogs, and apps.
- OV (Organization Validation) — Confirms the domain and the organization's identity. Takes 1-3 days. Shows the organization name in certificate details. Better for businesses where trust is a selling point.
- EV (Extended Validation) — The highest validation level. Requires thorough identity verification (can take days to weeks). Previously showed the green address bar, but browsers phased that out, so EV is less visually distinctive now.
By Domain Coverage
- Single-domain — Covers exactly one domain (e.g., example.com). Does NOT cover www.example.com unless explicitly included as a SAN.
- Wildcard (*.example.com) — Covers the root domain and all single-level subdomains (www, blog, app, etc.). Does NOT cover sub-subdomains like api.dev.example.com.
- Multi-domain (SAN) — Covers multiple different domains in a single certificate. Useful for agencies or anyone managing multiple sites.
Free SSL: Let's Encrypt
Let's Encrypt is a free, automated Certificate Authority backed by the Internet Security Research Group (ISRG) and supported by Google, Mozilla, and Cisco. It provides DV certificates trusted by all major browsers.
Let's Encrypt certificates expire every 90 days but renew automatically when configured correctly. Most modern hosts (Vercel, Netlify, Cloudflare, Kinsta) handle this automatically. The problem is when they don't — and you don't notice until a browser warning is already live.
SSL and Google SEO Rankings
Google confirmed HTTPS as a ranking signal in August 2014. It's a lightweight signal — a tiebreaker in close competition, not a silver bullet. But the SEO cost of NOT having SSL goes beyond rankings:
- Chrome marks HTTP sites as "Not Secure" — visible in the address bar, reduces trust immediately
- Mixed content warnings — HTTPS pages loading HTTP resources trigger browser warnings even with a valid cert
- HTTP/2 requires HTTPS — Without SSL, you're on the slower HTTP/1.1
- AI crawler preference — AI systems prefer HTTPS for citation indexing
Common SSL Certificate Problems
Expired Certificate
When a certificate expires, browsers show a full-page warning: "Your connection is not private." Users bounce immediately. Googlebot stops crawling properly. Revenue drops within hours of it going live. This is almost always preventable.
Set up auto-renewal and then verify it's actually working. Use our SSL Checker to monitor expiry dates on a schedule.
Hostname Mismatch
If your certificate is issued for example.com but your site serves www.example.com, users see a certificate name mismatch error. Fix it by using a certificate covering both, either via wildcard or by listing both as Subject Alternative Names.
Mixed Content
An HTTPS page that loads HTTP resources (images, scripts, iframes) triggers browser warnings even though you have a valid certificate. Fix by switching all resource URLs to HTTPS or using protocol-relative URLs (//example.com/resource.js).
Self-Signed Certificate
Self-signed certificates provide encryption but aren't trusted by browsers. Users see the same security warning as an expired cert. Never use them on production sites.
Weak Cipher Suites
Older SSL configurations may still allow weak encryption (RC4, 3DES, SSLv3). TLS 1.3 is the current standard. TLS 1.2 is the minimum you should accept. Our SSL Checker reports the protocol version and cipher suites in use.
How to Check Your SSL Certificate
Use our free SSL Checker tool to immediately see:
- Certificate expiry date and days remaining
- Certificate issuer (Let's Encrypt, DigiCert, etc.)
- Domains covered (Subject Alternative Names)
- TLS protocol version (1.2 vs 1.3)
- Overall security grade
Setting Up SSL Monitoring
Certificate expiry is one of the most preventable SEO disasters and one of the most common ones I see. Set up monitoring properly:
- Use a certificate monitoring service (UptimeRobot, StatusCake, or Better Uptime — all have free tiers)
- Set email alerts at 30 days, 14 days, and 7 days before expiry
- Add a recurring calendar reminder to check certificate health monthly
- Check your domain registrar's settings — domain and SSL expiring at the same time is a surprisingly common disaster
Quick SSL Security Checklist
- ✅ Certificate valid and not expired
- ✅ Covers both www and non-www (or redirects properly)
- ✅ TLS 1.3 supported (TLS 1.2 minimum)
- ✅ No mixed content on any page
- ✅ HSTS header enabled (tells browsers to always use HTTPS)
- ✅ HTTP redirects to HTTPS via 301
- ✅ Auto-renewal configured and verified working
Check your security headers with our HTTP Header Checker.