What is SSL certificate?
An SSL certificate (properly, a TLS certificate) is a digital certificate that binds a domain name to a public key so browsers can set up HTTPS securely.
An SSL certificate is a small data file, in the X.509 format, that ties a domain name to a cryptographic public key and is signed by a certificate authority (CA) that browsers trust. When a browser connects to your site over HTTPS, the server presents the certificate; the browser checks the signature, the domain and the dates, and only then sets up the encrypted connection.
The name is historical. SSL was replaced by TLS long ago, and today’s certificates are used exclusively with TLS 1.2 and 1.3. “SSL certificate” stuck as the everyday term, but “TLS certificate” is the accurate one.
What a certificate contains
- Subject Alternative Names (SAN) — the hostnames it’s valid for, such as
example.comandwww.example.com. A wildcard like*.example.comcovers one level of subdomains but not the bare domain itself. - Validity period — “not before” and “not after” dates.
- Issuer — the CA that signed it, plus intermediate certificates that link it to a trusted root.
- Public key and signature algorithm — typically RSA 2048-bit or ECDSA P-256.
DV, OV and EV — no SEO difference
Domain Validated (DV) certificates prove control of the domain; Organization Validated (OV) and Extended Validation (EV) add checks on the company behind it. Browsers no longer show EV with a special green bar, and search engines don’t rank sites differently by certificate type. A free DV certificate from Let’s Encrypt or your host is fully adequate for SEO.
Validity is getting shorter
The CA/Browser Forum, which sets the rules CAs follow, approved a schedule that cuts the maximum lifetime of public TLS certificates in steps: 200 days from March 2026, 100 days from March 2027 and 47 days from March 2029 (see the CA/Browser Forum). Manual renewal stops being realistic; automate it with the ACME protocol (RFC 8555), which most hosts, CDNs and tools such as Certbot support.
Inspecting a certificate
$ openssl s_client -connect example.com:443 -servername example.com \
</dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName
subject=CN=example.com
issuer=C=US, O=Let's Encrypt, CN=R11
notBefore=Sep 2 08:14:10 2026 GMT
notAfter=Dec 1 08:14:09 2026 GMT
X509v3 Subject Alternative Name:
DNS:example.com, DNS:www.example.comCommon mistakes
- Expired certificates. Browsers show a full-page warning most visitors won’t click through, and crawlers may fail to fetch pages.
- Missing hostnames. The certificate covers
wwwbut not the bare domain, or a new subdomain was added without reissuing. - Incomplete chain. The server doesn’t send the intermediate certificate. Some browsers repair this; other clients, including bots, fail.
- Blocking renewal. A DNS (Domain Name System) CAA record that doesn’t list your CA, or a firewall rule that blocks ACME validation requests, makes automated renewal fail silently.
How to check
The SSL Checker reports the issuer, validity dates and days left, covered domains (SAN), key and signature, TLS version and whether HTTP redirects to HTTPS. Once the certificate is solid, lock in HTTPS with HSTS (HTTP Strict Transport Security).
Frequently asked questions
Does the type of SSL certificate affect SEO?
No. Search engines treat DV, OV and EV certificates the same. What matters is that the certificate is valid, covers every hostname you use and is renewed on time.
How long is an SSL certificate valid?
Since March 2026 the maximum validity for public TLS certificates is 200 days, dropping to 100 days in 2027 and 47 days in 2029. Many free certificates, such as Let’s Encrypt’s, are shorter still, so automated renewal is essential.
Is SSL the same as TLS?
TLS is the modern successor to SSL, which is obsolete and disabled in browsers. People still say “SSL certificate”, but the certificates are used with TLS 1.2 and 1.3.