An SSL certificate is a digital file installed on a website's server. It encrypts the exchanges between the browser and the server, proves the identity of the domain name and activates the HTTPS protocol, recognisable by the padlock shown in the address bar.
According to W3Techs (2026), nearly 88% of websites serve their pages over HTTPS by default, and Chrome has flagged any site left on HTTP as "not secure" since July 2018.
Nexus Synergy, a WordPress and SEO agency, monitors and renews the SSL certificates of every site under a maintenance contract: this guide breaks down how they work, the types available and the steps to take when one expires.
An SSL certificate authenticates a website and encrypts the data travelling between the visitor and the server. Without it, there is no HTTPS, no padlock, and a security warning that scares off a large share of visitors before the page even loads. It is the technical foundation of trust online, for humans and for bots alike.
At Nexus Synergy, a WordPress and SEO agency, checking the SSL certificate is the first thing we do in any technical audit, because a site with shaky HTTPS starts out with a handicap before any other fix. This guide shows you what a certificate contains, how to choose between Let's Encrypt and a paid option, why Google and AI engines treat it as a prerequisite, and what to do when it expires on a Sunday night.
What exactly is an SSL certificate?
An SSL certificate is a data file issued by a certificate authority that binds a cryptographic key to the identity of a domain name. In practice, it acts as a digital ID card: the browser checks it before exchanging a single piece of data with the server.
A quick note on vocabulary, because the confusion is everywhere. The SSL protocol, created by Netscape in 1995, was replaced by TLS, its successor, whose version 1.3 dates from 2018. The technically correct term would therefore be "TLS certificate". Almost nobody uses it: common usage has stuck with "SSL certificate", and so has Google. We will do the same throughout this guide.
This file contains several verifiable pieces of information:
- Domain name: the domain or domains covered by the certificate, including subdomains where applicable
- Holder identity: the person or organisation that owns it, depending on the validation level chosen
- Issuing authority: the body that verified the request, such as Let's Encrypt, DigiCert or Sectigo
- Validity dates: issuance and expiry, a sore point that often causes trouble, more on that below
- Public key and digital signature: the cryptographic elements that make encryption possible
An honest clarification is in order. The padlock proves that the connection is encrypted, not that the site is trustworthy: a phishing site can get an SSL certificate in ten minutes. The certificate protects the channel, never the content.
How does an SSL certificate work?
An SSL certificate works through a two-step mechanism: a cryptographic handshake to authenticate, then symmetric encryption to exchange data quickly. Everything happens in a few milliseconds, before the first image even loads.
The principle relies on a key pair. The public key, included in the certificate, encrypts the data. The private key, stored on the server and never transmitted, decrypts it. What one key locks, only the other can open.
The sequence, known as the TLS handshake, unfolds like this:
- Initial contact: the browser asks the server to identify itself
- Certificate delivery: the server sends its SSL certificate along with its public key
- Verification: the browser checks the issuing authority, the domain and the validity dates
- Session key: both parties generate a temporary symmetric key, unique to that visit
- Encrypted exchanges: all browsing then flows through this secure HTTPS channel
Since TLS 1.3, this handshake takes a single network round trip, compared with two before. The concrete gain: a few dozen milliseconds per connection, which matters when you are aiming for an LCP under 1.5 s as we do on our projects. Here, security and speed pull in the same direction.
What are the different types of SSL certificate?
There are three validation levels (DV, OV, EV) and two coverage formats (wildcard and multi-domain). The validation level changes what the authority checks about you, while the format changes the number of domains protected. Here is the comparison table we use with our clients to decide:
| Certificate type | What is verified | Typical use | Indicative price | Issuance time |
|---|---|---|---|---|
| DV (domain validation) | Control of the domain only, via DNS or file | Showcase sites, blogs, the vast majority of sites | $0 (Let's Encrypt) to $50/year | A few minutes |
| OV (organisation validation) | Domain + real existence of the company | Corporate sites, institutions, intranets | $50 to $200/year | 1 to 3 days |
| EV (extended validation) | Domain + in-depth legal verification | Banks, insurers, large e-commerce | $150 to $500/year | 3 to 10 days |
| Wildcard | One domain and all its subdomains (*.domain.com) | SaaS, multisites, staging environments | $0 (Let's Encrypt via DNS) to $300/year | Minutes to a few days |
| Multi-domain (SAN) | Several distinct domains in a single certificate | Groups, agencies, brand portfolios | $80 to $400/year | Varies with the validation |
A detail that few guides mention: since Chrome 77, released in September 2019, browsers no longer show the green bar or the company name for EV certificates. The visual advantage that justified their price has vanished. What remains are contractual guarantees and compliance requirements, useful in banking or insurance, needless elsewhere.
To choose, three questions are enough:
- How many domains: a single site, subdomains, or a portfolio of brands
- What identity to prove: a simple technical check or a legal verification of the company
- What automation capacity: a manual annual renewal or a cron job that runs on its own
Let's Encrypt or a paid certificate: what to choose in 2026?
For the vast majority of sites, a free SSL certificate from Let's Encrypt does exactly the same encryption job as a paid one. The security level of the channel is identical: same TLS, same algorithms, same padlock. What changes is the validation, the support and the guarantees.
According to Let's Encrypt (2025), more than 550 million websites use its free certificates, valid for 90 days and renewed automatically. Most serious hosts, o2switch, OVHcloud or Infomaniak for example, integrate it with one click. Frankly, paying $80 a year for a commercial DV on a showcase site makes no sense at all in 2026.
A paid certificate keeps its place in specific cases:
- OV or EV validation required: regulated sectors, tenders, internal compliance policies
- Financial guarantee: commercial authorities insure the certificate up to several hundred thousand dollars
- Dedicated support: someone you can reach, which Let's Encrypt, a non-profit project, does not offer
And the market has just shifted. The CA/Browser Forum, the body that sets the rules between authorities and browsers, has cut the maximum lifespan of certificates to 200 days as of 15 March 2026, down from 398 days before. It will drop to 100 days in March 2027, then 47 days by 2029. In other words, manual renewal is doomed in the short term: automation, Let's Encrypt's long-standing model, is becoming the norm for everyone, paid certificates included.
Why the SSL certificate matters for Google and AI engines
HTTPS has been an official ranking signal at Google since its August 2014 announcement, and an implicit prerequisite for appearing in AI answers in 2026. An HTTP site is not merely penalised: it is sidelined across every search surface.
Let's be precise about the reach of the signal. Google has always described it as light, a tie-breaker between two similar pages. An SSL certificate has never made thin content rank, and it never will. The real stake lies elsewhere:
- Browser warnings: Chrome has flagged HTTP pages as "not secure" since July 2018, and the bounce rate reflects it immediately
- Access to HTTP/2 and HTTP/3: browsers only enable these fast protocols over HTTPS, a point detailed in our guide to improving your website's speed
- Trust from AI engines: GPTBot, ClaudeBot and PerplexityBot rely heavily on HTTPS sources, and 48% of Google queries trigger an AI Overview in 2026
- Conversion: no visitor leaves their card details behind a security warning
In our view, the question of the HTTPS "SEO bonus" has been settled for a long time. The SSL certificate does not win you the race. Its absence bars you from even reaching the start line, on Google as much as in the answers from ChatGPT or Perplexity.
SSL certificates and WordPress: the three failures we fix most often
On WordPress, which powers 43.5% of websites according to W3Techs (2026), SSL certificate problems almost always follow the same three scenarios. At Nexus Synergy, roughly half of our projects are redesigns or takeovers, and these three failures recur in a large share of the sites we inherit.
- Mixed content: the page is on HTTPS but loads images or scripts over HTTP, the padlock drops and the console shows mixed content warnings
- Failed renewal: the renewal cron fails silently, often after a DNS or host change, and the site goes down after 90 days
- Redirect loop: a CDN like Cloudflare in "Flexible" SSL mode combined with a server-side HTTPS redirect, and the browser shows ERR_TOO_MANY_REDIRECTS
Mixed content is the most common one after an HTTP to HTTPS migration. The cause: absolute http:// URLs stored in the database. The lasting fix goes through a search-and-replace in the database with a tool like Better Search Replace, rather than a plugin that rewrites URLs on the fly and masks the problem.
These interventions are part of the daily routine of our WordPress maintenance service, from $150 per month with monitoring, daily backups and security patches. And remember: a valid padlock does not prove that a site is healthy. A compromised WordPress keeps its SSL certificate intact, as we explain in our guide on the hacked WordPress site.
What to do when your SSL certificate has expired?
An expired SSL certificate blocks access to the site: Chrome shows ERR_CERT_DATE_INVALID as a full-page warning and almost all visitors leave. Traffic collapses in a few hours, not a few days. The good news: the repair rarely takes more than an hour when you work through it in order.
Here is the checklist we apply on site:
- Diagnose: run the domain through Qualys SSL Labs to confirm the expiry and spot any intermediate chain issue
- Renew: restart the issuance from the host (AutoSSL, built-in Let's Encrypt) or via certbot on the command line
- Purge: clear the server cache and the CDN, otherwise the old certificate keeps being served
- Verify: test in private browsing and on mobile, then check the date of the new expiry
- Prevent: set up an expiry alert at 30 days, with UptimeRobot or the host's monitoring
The last step is the only one that really counts. With lifespans cut to 200 days in 2026, then 100 days from 2027, a forgotten renewal is no longer a rare accident but a statistical certainty for any site managed by hand. Expiry monitoring is in fact part of our full checklist, which you will find in our WordPress maintenance guide.
Frequently asked questions about SSL certificates
Is a free SSL certificate as secure as a paid one?
Yes, the encryption level is strictly identical. A free DV certificate from Let's Encrypt uses the same TLS protocols and the same algorithms as a commercial certificate costing $300 a year. The difference lies in identity validation (an OV or EV certificate verifies the legal existence of the company), in customer support and in the financial guarantees included. For a showcase site, a blog or most online shops, the free option covers every real need. Paid certificates keep their value in regulated sectors, where compliance requires organisation validation, or when an IT department demands contractual support.
How long is an SSL certificate valid in 2026?
Since 15 March 2026, the maximum lifespan of an SSL certificate is 200 days, by decision of the CA/Browser Forum, down from 398 days before. The schedule is already set for what follows: 100 days maximum from March 2027, then 47 days by 2029. Let's Encrypt certificates, for their part, have always lasted 90 days, with automated renewal. This gradual reduction aims to limit the exploitation window of a compromised key. The practical consequence for site owners: manual renewal becomes untenable, and automating the certificate lifecycle shifts from a convenience to an obligation.
How do I know if my site has a valid SSL certificate?
Click the icon shown to the left of the URL in your browser: the certificate details show the domain covered, the issuing authority and the expiry date. For a more thorough check, the free Qualys SSL Labs tool gives a grade from A+ to F and detects problems invisible to the naked eye, such as an incomplete certificate chain or an obsolete protocol still active. Also make sure that all versions of your domain (with and without www, HTTP and HTTPS) properly redirect to the single HTTPS version. A technical audit spots this kind of gap in a few minutes, and it is a point we check systematically.
Does an SSL certificate really improve Google rankings?
Yes, but the direct effect stays modest and it has to be said honestly. Google confirmed HTTPS as a ranking signal in August 2014, while making clear that it is a light criterion, on the order of a tie-breaker between equivalent pages. The indirect impact is far heavier: an HTTP site suffers Chrome's "not secure" warning, loses access to the fast HTTP/2 and HTTP/3 protocols, and sees its bounce rate climb, all behavioural signals that weigh on ranking. In 2026, with 48% of Google queries triggering an AI Overview, a site without an SSL certificate also drops off the radar of AI engines.
What actually happens when an SSL certificate expires?
The browser blocks access to the site with a full-page warning, such as ERR_CERT_DATE_INVALID on Chrome. Most visitors will go no further, and they are right to: bypassing that screen is a bad security habit. The consequences pile up quickly, traffic dropping within hours, abandoned carts, transactional emails sometimes rejected and a dented brand image. On the SEO side, an expiry fixed within a few hours has no lasting effect, but a certificate left dead for several days degrades user signals. The remedy fits in one line: an expiry alert at 30 days and an automated renewal.
Do you need an SSL certificate for a simple showcase site with no payment?
Yes, without the slightest hesitation, even with no transaction or sensitive form. First because Chrome and Firefox mark any HTTP site as not secure, which ruins a company's credibility before the first contact. Second because the smallest form, even a simple quote request, transmits personal data that must be encrypted, as GDPR requires. And the cost argument has disappeared: a free DV certificate installs in a few minutes with every serious host. In 2026, a showcase site on HTTP sends a single message to its visitors and to Google alike: this site is not looked after.
Unsure about the state of your SSL certificate, an HTTPS migration to secure or a renewal that has already lapsed? Nexus Synergy offers a first complete audit across three areas (technical, SEO, AI visibility), with a firm quote within 24 hours. Tell us about your site: we will quickly know whether your HTTPS is working for you or against you.
