SSL (Secure Sockets Layer) is the protocol that encrypts the data exchanged between a visitor's browser and the server hosting the site, so that anyone intercepting the connection sees only unreadable characters instead of passwords, email addresses and card numbers.
The name, however, has outlived the technology. The protocol actually running on your site is called TLS, and SSL has survived as a sales label on the certificates you buy. If you are looking for what matters in practice in 2026, it is not which certificate you choose: it is how often you renew it. Since March the maximum lifetime has dropped to 200 days, and it will keep falling until it reaches 47.
The protocol is called TLS, and no version of SSL is still standing
SSL 3.0 was deprecated by the IETF with RFC 7568 in June 2015, a document whose working title was literally draft-ietf-tls-sslv3-diediedie. Its successor went the same way in its first two versions: RFC 8996, published in 2021, states that TLS 1.0 and TLS 1.1 MUST NOT be used and moves both specifications to Historic status.
That leaves TLS 1.2, which had already replaced 1.1 in 2008, and TLS 1.3, published as RFC 8446 in 2018. When a hosting provider sells you an "SSL certificate", what you install is an X.509 certificate that will be used by TLS. The old acronym stuck because changing it would have meant rewriting control panels, price lists and documentation across half the industry.
What a certificate contains and who signs it
A certificate is a file on the server containing the domain name, the public key, the issue date, the expiry date and the signature of whoever issued it. The issuer is a certificate authority: DigiCert, Sectigo, GlobalSign, Let's Encrypt. Browsers trust a list of authorities they ship with, and a certificate you sign yourself technically works but is not on that list, so Chrome and Firefox reject it.
When the connection opens, browser and server perform a handshake: the server sends the certificate, the browser checks that the signature is valid and that the domain matches, then the two agree on a session key used to encrypt the rest of the exchange. It takes milliseconds and is repeated for every new session. It is the part of technical SEO nobody looks at until it stops working.
DV, OV and EV change the verification, not the encryption
This is where search results get muddled. On Google UK for "ssl certificate types" (September 2026), the snippet shown for the guide in second place, published by a certificate authority, lists security alongside verification depth as something that varies between DV, OV and EV, even though the article itself says a DV certificate provides industry-standard encryption. The article body has it right: the strength of the encryption depends on the TLS version negotiated and the cipher suite client and server choose, not on the type of certificate. A free DV certificate from Let's Encrypt and a paid EV certificate produce exactly the same connection. What changes is who checked what before signing.
| Type | What the authority checks | Typical turnaround | What the user sees | Encryption |
|---|---|---|---|---|
| DV (Domain Validated) | Control of the domain only: a DNS record, a file on the server or an email to the contact address | Minutes | Padlock | Identical |
| OV (Organization Validated) | Domain plus the legal existence of the organisation | Days | Padlock; company details in the certificate details | Identical |
| EV (Extended Validation) | Domain plus an in-depth documentary check of the organisation | Up to a week | Padlock; company details in the certificate details | Identical |
The green bar with the company name, which some guides still describe as the hallmark of EV, no longer exists. The Chromium documentation explains that from Chrome 77 that indicator was moved into the Page Info panel, the one that opens when you click the padlock. The reason: a field experiment by the Chrome Security UX team, along with a series of earlier academic studies, had shown that users did not change their behaviour when the indicator was removed. Apple had already made the same choice in Safari in 2018, with iOS 12 and macOS 10.14.
For a business website that does not handle payments itself, then, the price difference between DV and EV buys one extra line in a panel almost nobody opens.
Certificate lifetimes are collapsing, and this is the change that affects you
On 11 April 2025 the CA/Browser Forum approved ballot SC-081v3 with 25 votes in favour and none against among the certificate authorities, and a unanimous vote from the four browser makers at the table: Apple, Google, Microsoft and Mozilla. The ballot rewrote section 6.3.2 of the Baseline Requirements, which sets the maximum lifetime of a public TLS certificate.
| Certificates issued from | Until | Maximum lifetime |
|---|---|---|
| (previous rules) | 15 March 2026 | 398 days |
| 15 March 2026 | 15 March 2027 | 200 days |
| 15 March 2027 | 15 March 2029 | 100 days |
| 15 March 2029 | onwards | 47 days |
We are in the first window: a certificate issued today cannot exceed 200 days, and the Baseline Requirements recommend staying under 199. In 2029 it will be 47, a little over six weeks. The same ballot also shortens how long domain validation data can be reused, which falls step by step from 398 to 10 days.
The operational consequence is simple: renewing by hand, with the expiry date marked in a calendar, stops working. With 47 days of validity a site has to be renewed eight times a year. The ACME protocol and the clients that implement it, certbot first among them, have existed for years for exactly this reason, and most hosting providers have already built them into their control panels. It is worth checking today whether your site renews automatically, because an expired certificate does not hurt rankings: it makes the site unreachable behind an error screen the visitor has to click through manually, and almost nobody does.
How much HTTPS really counts for rankings
Google announced HTTPS as a ranking signal on 7 August 2014, in a post signed by Zineb Ait Bahajji and Gary Illyes. It is worth rereading how they put it, because the wording is far more cautious than the industry later made out: "for now it's only a very lightweight signal", "affecting fewer than 1% of global queries, and carrying less weight than other signals such as high-quality content".
Google has not published any update on that weight since. The most recent public figure on the subject is therefore eleven years old, and should be read for what it is: HTTPS sits very low among the ranking factors. What really moves results is elsewhere. Chrome flags any page served over HTTP as not secure, a contact form without encryption shows an explicit warning next to the field, and on a page marked that way a checkout does not get completed. If you run an e-commerce site, the issue is conversion before it is ranking.
What breaks when a site moves to HTTPS
Installing the certificate is the easy part. The problems come from everything around it, and they are always the same four. Google's documentation on enabling HTTPS lists them all.
- Mixed content. The page is served over HTTPS but loads images, scripts or stylesheets over HTTP. The browser blocks the scripts and removes the padlock. The fix is to make URLs pointing to resources on the same site relative.
- Missing or chained redirects. Every HTTP URL must respond with a 301 redirect to the matching HTTPS page, not to the home page. A chain of http, then https, then www, then the final page adds latency to every request and complicates crawling.
- HSTS not enabled. The Strict-Transport-Security header tells the browser to use HTTPS from the next visit onwards, skipping the first unencrypted hop.
- Search Console. HTTP and HTTPS are two separate properties. After the migration the new one has to be added and verified, otherwise the data stops for no apparent reason.
On speed, the idea that HTTPS slows a site down dates from a time when handshakes cost more and connections were not reused. With TLS 1.3 the handshake needs one round trip fewer than 1.2, and HTTP/2, which browsers only negotiate over encrypted connections, reduces the number of connections needed. If your site is slow, the cause is almost always somewhere else.
For periodic checks, Qualys' SSL Labs test, already cited by Google in the 2014 post, is still the most widely used tool: it grades the configuration and tells you which TLS versions and cipher suites the server still accepts. A server that still answers in TLS 1.0 gets an F, and the fix is one line of configuration. If you are working on the technical side of the site, this point fits naturally into an SEO checklist, and when the work concerns a live site with real traffic it is worth having it overseen by whoever manages the project's SEO, because a badly handled HTTPS migration costs months of visibility.
One thing the industry rarely says: the padlock has never certified the honesty of whoever is on the other side. It certifies that the connection is encrypted and that the domain you are connected to is the one written in the address bar. A phishing site gets a DV certificate in a few minutes, for free, exactly like yours, and the browser shows it the same padlock. For years users were taught to look for that symbol before entering their card details, and it is one of the reasons Chrome stopped showing positive indicators and moved to flagging only what is wrong. The certificate is a minimum requirement, not a credential.
SSL FAQs
No, they are two different protocols, but in everyday use the two names overlap. SSL is the original protocol, now entirely deprecated: RFC 7568 of 2015 retired the last remaining version, 3.0. TLS is its successor, and the versions still valid are 1.2 and 1.3. When you buy an SSL certificate, you are buying a certificate that will be used by TLS.
No. The encryption of the connection depends on the TLS version and cipher suite negotiated, not on the price of the certificate. A free DV certificate from Let's Encrypt protects the connection exactly like a paid one. What you pay extra for is the verification of the organisation's identity and, usually, a contractual warranty from the issuing authority.
A certificate issued today cannot exceed 200 days. Section 6.3.2 of the CA/Browser Forum Baseline Requirements has the limit falling to 100 days from 15 March 2027 and to 47 days from 15 March 2029. Before 15 March 2026 the maximum was 398 days.
The browser blocks access to the site and shows a connection-not-private warning, which the visitor can only get past by clicking an option hidden behind a button. In practice traffic drops to zero until the certificate is renewed. With lifetimes getting shorter, the only reliable defence is automatic renewal via ACME.
Qualys' SSL Labs test is the most widely used tool: it analyses the server, gives a grade from A to F and shows which TLS versions and cipher suites are still accepted. A server that answers in TLS 1.0 or 1.1 is marked down, and the fix is a configuration change.
