What Is an SSL Certificate — and Why It's Free Now

Aug 03, 2026 · SEO Glossary

Click the padlock (or the tune icon, depending on your Chrome version) in the address bar, open "Connection is secure", then "Certificate is valid" — and you're looking at the file this article is about. Before your browser rendered a single byte of this page, it checked that file's signature chain, its expiry date, and whether its listed hostnames matched the domain you typed. That check is what people mean when they ask what is an SSL certificate doing for a website: it's the trust anchor for the entire encrypted connection.

What Is an SSL Certificate, Technically?

An SSL certificate — properly a TLS certificate, since the SSL protocol itself was deprecated years ago, but the old name stuck — is an X.509 file binding a public key to a domain name, signed by a certificate authority (CA) that browsers already trust. It contains:

• Subject and SANs — the domains it covers. Modern browsers ignore the old Common Name field entirely and only read the Subject Alternative Name list, a detail that still breaks hand-rolled internal certs.
• The public key — used during the TLS handshake to establish an encrypted session.
• Validity window — "not before" and "not after" timestamps. Public certificates have been capped at 398 days since 2020, and the industry has been ratcheting this down further.
• Issuer and signature — the CA that vouches for it, chaining up to a root certificate shipped inside your operating system or browser.

The certificate itself doesn't encrypt your traffic. It authenticates the server so the handshake can negotiate session keys that do. Certificates answer "am I really talking to example.com?"; the cipher does the rest. If you want the full picture of the protocol around it, our HTTPS guide covers the handshake end to end.

Validation Levels: What the CA Actually Checks

Here's the part sales pages won't tell you: the encryption is identical across all three. A free DV certificate negotiates the same TLS 1.3 ciphers as a $300 EV one. And since Chrome removed the green EV company-name bar from the address bar back in 2019, EV certificates have no visible presence for users either. OV and EV survive mostly in enterprise procurement checklists.

Let's Encrypt Changed the Economics

Until 2015 or so, certificates cost real money and renewing them was a manual chore, which is why half the web was still plain HTTP. Let's Encrypt — a nonprofit CA — made DV certificates free and, more importantly, automated. Its ACME protocol lets your server prove domain control and fetch a certificate with zero human involvement. Certificates last 90 days by design, forcing you to automate renewal with certbot or your platform's built-in integration. Cloudflare, Vercel, Netlify, and most managed hosts now provision certificates silently. The practical consequence: paying for a DV certificate in 2026 buys you nothing, and there is no cost-based excuse for an HTTP-only site.

Why SEO People Care About a Security File

Google announced HTTPS as a lightweight ranking signal in 2014, but the ranking boost was never the real story. The real story is what happens without a valid certificate: Chrome labels the site "Not secure", and an expired or mismatched certificate throws a full-page interstitial that most visitors will not click through. Traffic doesn't dip — it cliffs. A related failure mode is serving the page over HTTPS while loading scripts or images over HTTP, which browsers block or flag; that's mixed content, and it's the most common leftover after an HTTPS migration.

How to Inspect and Monitor a Certificate

Three ways, in increasing order of automation:

1. DevTools. Open the Security panel (not the padlock — the actual Security tab in DevTools). It shows the protocol version, key exchange, certificate validity, and flags any subresources loaded insecurely.
2. OpenSSL from a terminal. openssl s_client -connect example.com:443 -servername example.com | openssl x509 -noout -dates -ext subjectAltName prints the validity window and covered hostnames. The -servername flag matters: without SNI you may get the server's default certificate, not the one your domain serves.
3. Scheduled monitoring. Certificates expire on weekends and holidays, never conveniently. A monitoring service like WebsiteChecker.Tech checks your certificate on every scheduled crawl and warns you while the fix is still a non-event. Given that automated 90-day renewals fail silently when a DNS record changes or a rate limit trips, an external check is the only reliable safety net.

Failure Modes Worth Knowing by Name

• NET::ERR_CERT_DATE_INVALID — expired certificate, or a client clock that's badly wrong.
• NET::ERR_CERT_COMMON_NAME_INVALID — the domain isn't in the SAN list; classic when www and apex are covered by different certs.
• Incomplete chain — the server sends its leaf certificate without intermediates. Desktop browsers often paper over this by fetching the missing link; older Android and many API clients just fail. Test with SSL Labs rather than trusting your own Chrome.