SSL is the technology that encrypts the connection between a website and a visitor’s browser, so passwords, form entries and payment details cannot be read or changed in transit. Today the protocol actually in use is TLS, the successor to SSL, but the name has stuck. Every website needs a certificate, and for most sites it is free: hosting plans such as Tremhost’s issue and renew one automatically.<\/p>\n
SSL stands for Secure Sockets Layer. It was developed in the 1990s and has since been replaced by TLS, Transport Layer Security. All versions of SSL are deprecated because of known weaknesses, and modern browsers and servers use TLS 1.2 or TLS 1.3. When hosts and certificate sellers say “SSL certificate”, they mean a certificate used for TLS. The certificate works the same way whichever name you use.<\/p>\n
An SSL certificate is a small data file installed on the web server and issued by a certificate authority (CA), an organisation that browsers trust. It does three jobs:<\/p>\n
When someone visits a site over https, the browser and server perform a short exchange called the TLS handshake:<\/p>\n
This takes a fraction of a second. If any check fails, for example because the certificate has expired, the browser shows a full-page warning and most visitors leave.<\/p>\n
Chrome, Edge, Firefox and Safari mark plain http pages as “Not secure”, with more prominent warnings on pages that contain forms. Many visitors will not contact a business whose site carries a security warning.<\/p>\n
Contact form messages, quote requests, login details, job applications and order information all cross networks you do not control. SSL encrypts that traffic so it cannot be read or altered along the way.<\/p>\n
Payment providers and card industry rules expect encrypted connections wherever payment details are handled, and browsers restrict password fields on http pages. If you sell online or have a login area, https is essential across the whole site.<\/p>\n
Google has used https as a lightweight ranking signal since 2014. It will not lift a weak page to the top, but running without it puts you behind competitors who have it.<\/p>\n
Browsers only use HTTP\/2 and HTTP\/3 over encrypted connections, and features such as location access and service workers only work on https pages.<\/p>\n
All certificates encrypt traffic the same way. They differ in how much the CA checks before issuing and how many names they cover.<\/p>\n
In everyday use, yes. TLS replaced SSL, and the certificates sold as “SSL certificates” are used for TLS connections. Your server should support TLS 1.2 and TLS 1.3 only.<\/p>\n
Most websites do not. A free DV certificate gives the same encryption. Choose a paid certificate when you need your organisation verified, a warranty, or wildcard or multi-domain coverage.<\/p>\n
Usually the site is still loading some images or scripts over http, or http addresses are not redirected to https. Fix the mixed content and add a site-wide redirect.<\/p>\n
No. It protects data travelling between visitors and your server. You still need updates, strong passwords, backups and malware scanning.<\/p>\n