What is an SSL Certificate? How They Work and Why They’re Important

What is an SSL Certificate?

A secure sockets layer (SSL) certificate is a digital certificate that guarantees the authenticity of your website, meaning that your website represents itself truthfully and visitors will find the content they expect. The SSL protocol encrypts communication between computers while the communication is in transit. Essentially, once the receiving party takes possession of the communication on a webpage or in their email inbox, they can read it. If anyone intercepts the SSL-certified communication while it’s in transit, it will be illegible and meaningless.

As general awareness for web security grows, more and more people look for these certificates to determine whether a website is safe to visit. The certificates show that the website owner is doing their due diligence to help keep the site secure.

How do you know if a website has an SSL certificate?

When browsing the web, you might not pay close attention to the address bar of your browser. But once you launch your favorite online store, special interest website, or blog, there’s a good chance you’ll start to notice a few more of the behind-the-scenes details.

For instance, on a website that doesn’t have an SSL certificate, the URL will start with “HTTP.” On sites with an SSL certificate, however, the URL will start with “HTTPS.” That extra S means that your browsing session, communication, and shopping experience are secure from the moment you arrive at the website.

That single letter indicates that any data passed between the website and its visitors will remain private and secure. It means that the website provides visitors with encryption intended to prevent hackers—or any other unwanted third parties—from stealing their confidential information, especially information that could lead to identity theft. For instance, hackers can potentially steal your identity by accessing details such as:

• Full name
• Address
• Telephone number
• Bank information
• Credit card number
• Social Security number

This is the kind of information your customers might submit when setting up an account or completing a transaction on your website, so you want to let them know that your business has taken every possible step to protect their data. Without these precautions, your prospective customers might decide not to risk visiting your site, and you stand to lose your existing and valued customers with whom you’ve spent time building a relationship.

Who needs an SSL certificate and why?

In the past, industry experts only seriously recommended SSL certificates to e-commerce websites that handled sensitive, confidential information and needed to ensure that the connection between merchant and customer was secure.

Today, experts agree that SSL certificates are beneficial for anyone who wants to instill confidence in site visitors—whether you’re running a freelance business, blogging, or anything in between. People who navigate to your site should feel safe while searching through your inventory, reading about your services, watching embedded videos, signing up for your newsletter, or making a purchase.

Additionally, anyone who doesn’t invest in an SSL certificate might also have to deal with the consequences doled out by the Google algorithm, which is Google’s website ranking system. The Google Chrome browser flags websites without a current SSL certificate and limits their exposure, thus downgrading them and landing them farther down in search results. If you don’t get and maintain an SSL certificate, you might find your site’s listing dropping to pages 2, 3, or even lower.

Since the release of Google Chrome 62 in 2017, Google has displayed flags that indicate when a website is not secured by an SSL certificate. And with Google Chrome owning the highest percentage of browser market share worldwide, having an up-to-date SSL certificate is essential to avoid alerting your visitors to your lack of encrypted protection and authentication.

What are the differences between various types of SSL certificates?

Now that we’ve discussed the benefits of an SSL certificate—and explained why your site should have one—it’s time to dig a bit deeper into the different types of SSL certificates that are available.

It’s important to note that all SSL certificates offer the same level of encryption. Where they differ is in the level of verification the business undergoes in order to obtain the certificate.

Extended Validation

An extended validation (EV) SSL certificate is the most respected form available, offering the highest level of trust for visitors to your site. These premium-level certificates require the website and business to undergo intensive vetting to ensure they are legitimate and own the domain in question.

Organization Validation

An organization validation (OV) SSL certificate requires less verification than an EV but still assures customers that your business is a legitimate legal entity and that you own your domain.

Domain Validation

The domain validation (DV) SSL certificate is the easiest to obtain. EV and OV certificates require several steps, including a vetting process that can take a few days to complete. DV certificates only require one simple step—you just need to prove that you own the domain.

Unfortunately, because DV SSL certificates don’t require as much in the way of verification, it’s easier for bad actors—like phishers, for example—to get them and make their fraudulent sites look legitimate. So if your website is going to be handling sensitive customer information, it’s a good idea to go through the vetting process and obtain a higher-level certificate.

While the above SSLs are the most common certificates, there are a few others you might consider as well.

Multi-Domain Validation

A multi-domain validation certifies multiple domains owned by the same person under a single certificate. This validation can save you time and money, but there are limits—every time you add a new domain, you must request a reissued SSL certificate to authenticate it.

Wildcard Validation

If you want to use one domain and have the flexibility of adding subdomains, a wildcard SSL certificate might be right for your business. These validations cover your base domain and an unlimited number of subdomains. Further, it’s fairly simple to have a new certificate reissued for each new subdomain.

When deciding which type of certificate you should get for your site, go for the maximum amount of security that is reasonable and affordable for your business.

Where can you get an SSL certificate?

Getting an SSL certificate isn’t difficult, but selecting the right certificate and the right provider is important. Choosing the wrong type of certificate for your business or improperly installing the one you select could be just as damaging as not having any certificate at all.

Check with your web host to find out if an SSL certificate comes with your current hosting plan. If your host does provide a certificate, review the details and see if it gives you the level of validation you want for your site. If you’d like a higher level of validation, the host might offer other options for an additional fee. You can also go beyond your web hosting plan and select an outside certificate authority to vet your credentials against your desired level of validation.

Once you’ve acquired the SSL certificate best suited to secure your website, you’ll know it’s in place when you see a padlock in front of your web address. However, simply seeing the padlock doesn’t guarantee that your certificate is installed correctly. Testing your website with a service like SSL Labs can help ensure your certificate fully protects you and your visitors.

Is a TLS certificate better than an SSL certificate?

Transport layer security (TLS) was introduced in 1999 as a successor to SSL, but industry experts still refer to them interchangeably—or together as “SSL/TLS.” Both are cryptographic protocols that serve to conceal information transported across networks until it reaches the intended party. So don’t worry—whether it’s called an SSL or TSL certificate (and it’s much more likely to be called SSL)—it supports both protocols.

Optimize site security with an SSL certificate

Companies that build their own web servers should know what an SSL certificate is. Installing one secures an encrypted connection for their users and can help your customers shop with confidence on your website.

An active, up-to-date SSL certificate on your website can be vital to your business. It can prevent some browsers from flagging your website as a security risk and benefit your site’s Google search ranking. But, most importantly, it’s an easy way to ensure that your customers’ sensitive information is encrypted, and it’ll go a long way toward generating trust and goodwill.

Ready to get your website up and running? Use Mailchimp to buy a domain, create your website, and start cultivating an online presence.

Frequently asked questions

Is an SSL certificate free?

Securing a free SSL certificate is an enticing offer, especially for small businesses working with a limited cybersecurity budget. However, there are some limitations if a business owner goes with this approach.

For instance, a free SSL certificate only lasts for 90 days, meaning you’ll have to renew it every three months. Also, a free SSL certificate has a limited number of certificate options available. They protect the primary domain, but they may not protect landing pages hosted on subdomains, for example.

Do I need an SSL certificate for my website?

All websites that ask users to share personal information or offer e-commerce features should strongly consider getting an SSL certificate. If you fail to obtain an SSL certificate, search engine browsers may perceive your website to be "non-secure" and warn their users of the dangers if they click on your link. Also, SSL certificates are considered a ranking signal, so it may be harder to access your site without having a certificate on the server.

An SSL certificate benefits both your company and the customers who visit your website by keeping sensitive information secure. Ultimately, getting an SSL certificate can make customers feel more comfortable when exploring and shopping on your website, and this in turn can generate more web traffic.

Can SSL be hacked?

In today's online world, the threat of a website being hacked is high. However, the odds are lowered if you have an SSL certificate installed on your server. While SSL certificates aren’t absolutely foolproof and can technically be hacked, the likelihood is very low. Essentially, SSL certificates serve as an extra layer of protection that can protect you from hackers and cybercriminals.