What Is an SSL Certificate? How It Works, Types and the 47-Day Rule

An SSL certificate is a digital document, signed by a certificate authority (CA), that proves a website's domain really is controlled by whoever runs the site, and that allows the connection between the browser and the server to be encrypted. A site with a certificate opens with "https://", so the form data, passwords and payment details visitors enter cannot be read or altered in transit. Its technical name today is a TLS certificate, but "SSL certificate" is the name that stuck. As of 2026, two developments have put the topic back on the agenda: certificate lifetimes are getting shorter, and Chrome is starting to warn users by default before they open sites that do not use HTTPS.

Are SSL and TLS the same thing?

They are the old and new names of the protocol that does the same job. SSL (Secure Sockets Layer) came first. Its last version, SSL 3.0, was deprecated in 2015 by RFC 7568 because it was not secure enough. TLS (Transport Layer Security) replaced it. When you buy an "SSL certificate" today, you are actually getting a certificate used in a TLS connection. Making sure your server disables old SSL versions and older TLS versions and uses current TLS versions matters as much as the certificate itself.

How does an SSL certificate work?

When a visitor arrives at your site, a short handshake takes place between the browser and the server before the page loads:

1. The server sends its certificate to the browser.
2. The browser checks the certificate: is it signed by a certificate authority it trusts, has it expired, and does the domain on it match the address that was entered?
3. The server proves with a signature that the key in the certificate really belongs to it.
4. Both sides agree on an encryption key that belongs only to this session, and the whole page is transferred encrypted with that key.

If any of these checks fails, the browser shows a full-page security warning instead of the page. To a visitor, an expired certificate has the same effect as "this site has been hacked", which is why renewing a certificate is as important as installing it.

What types of SSL certificates are there?

Certificates differ in two ways: what is validated, and how many domains they cover.

By validation level:

• DV (domain validated): only your control of the domain is validated. It can be issued automatically within minutes. Technically sufficient for corporate sites, blogs and most e-commerce sites.
• OV (organization validated): in addition to the domain, the company's existence is checked, and the company name appears in the certificate details.
• EV (extended validation): the strictest organization check.

Encryption strength is the same across all three. The difference lies in the scope of the information that has been validated inside the certificate.

By coverage:

• Single domain: only example.com or www.example.com.
• Multi-domain (SAN): several different domains in one certificate.
• Wildcard: covers all subdomains of the same domain (such as blog.example.com and panel.example.com) with one certificate. Practical for setups with many subdomains, but if the key is compromised, the impact is just as wide.

Is a free SSL certificate enough?

For most sites, yes. Free certificate authorities such as Let's Encrypt issue DV certificates, and in terms of encryption they are no different from a paid DV certificate. Paid certificates usually differ in OV or EV validation, support services and extra guarantees offered by the provider. Unless a contract or tender requires your organization's details to appear in the certificate, a correctly installed, automatically renewed free DV certificate will be enough for a corporate or e-commerce site.

What is changing for SSL in 2026?

Certificate lifetimes are getting shorter. The CA/Browser Forum, which sets the rules for browsers and certificate authorities, approved ballot SC-081v3 in April 2025. It sets a schedule to reduce the maximum validity of certificates step by step from 398 days to 47 days. The reduction started in March 2026 and will be completed in March 2029. Let's Encrypt is also cutting the lifetime of its own certificates from 90 days to 45 days: the default profile moves to 64 days on February 10, 2027 and to 45 days on February 16, 2028. Let's Encrypt states plainly that manual renewal is not recommended and that you should make sure your renewal automation is compatible with short-lived certificates.

The practical result: the era of putting a yearly reminder in the calendar to renew your certificate is ending. Certificates should renew automatically with a tool that supports the ACME protocol, and you should set up monitoring that alerts you when a renewal fails.

Chrome warns on sites without HTTPS by default. According to the plan announced on Google's security blog, Chrome turns on the "Always Use Secure Connections" setting by default with Chrome 154, released in October 2026. This means Chrome asks the user for permission before they visit a public site that does not support HTTPS for the first time. With Chrome 147 in April 2026, the setting had already been turned on for users of Enhanced Safe Browsing. If you still have a site that opens only over HTTP, a significant share of your visitors will now see a warning screen before they reach it.

Does an SSL certificate affect SEO?

It does, but less directly than many people think. When Google announced in 2014 that it had started using HTTPS as a ranking signal, it described it as a very lightweight signal carrying less weight than other signals such as high-quality content. The real effect is indirect: visitors who see a browser warning leave, do not fill in forms and do not pay. HTTPS is not the reason a site ranks well; it is a precondition for a good experience.

What should you check after installation?

Installing the certificate is half the job. These are the gaps we see most often:

• Permanent redirect (301) from HTTP to HTTPS: both the www and non-www addresses should go to a single HTTPS address.
• Mixed content: images, scripts or fonts loaded over HTTP on an HTTPS page. Browsers may block them or show the page as not secure.
• Incomplete certificate chain: a site that opens fine on desktop may show an error on some mobile devices because an intermediate certificate is missing.
• Subdomains: subdomains such as your admin panel, email or test environment need certificates too.
• Automatic renewal and monitoring: test once that renewal really works, and set up an alert for certificates close to expiry.
• Search Console: if the site was moved from HTTP, make sure the HTTPS version is verified and the sitemap contains HTTPS URLs.

In short

An SSL (today, TLS) certificate proves your site's identity and encrypts the traffic between you and your visitors. A free DV certificate is enough for most sites; what matters is correct installation, automatic renewal and monitoring. With certificate lifetimes falling to 47 days by 2029 and Chrome moving to default warnings for sites without HTTPS, manually managed certificates and pages served over HTTP are no longer an acceptable risk.

If you want certificate management and renewal automation set up on your server, see our server and infrastructure service. If you are having a new site built, HTTPS and redirect setup are a standard part of our web design service.