What is HTTPS and what is an SSL certificate? What the padlock does and doesn’t guarantee
For anyone who has or will have a website: how the padlock works, what it costs, what happens when it expires and what we saw in a real certificate.
HTTPS is the encrypted version of HTTP, the protocol your browser uses to request pages from a website: everything that travels between the two is scrambled, so nobody along the way can read it or change it. An SSL certificate is the file that makes this possible: it proves you’re connected to the domain in the address bar and lets the connection be encrypted. That’s why the padlock says the connection is private, not that the business can be trusted.
An SSL certificate can cost nothing: there are free ones, and hosting companies that install and renew them for you. But it does expire: if it lapses, browsers show a warning instead of your page, so renewal has to be automatic.
Think of the mail. With HTTP, your website sends postcards that anyone can read along the way, like a coffee shop’s Wi-Fi network. With HTTPS they go in a sealed envelope, and your browser first checks the recipient’s ID: the certificate.
What is HTTPS?
HTTPS is HTTP, the protocol a browser and a website use to exchange pages, with a layer of encryption called TLS; the “S” stands for secure. You can spot it because the address starts with https://. Everything that travels, including what you type into a form, is encrypted and arrives intact.
Without HTTPS, Chrome’s help pages warn, someone may be able to view and change what you send and receive, and the page shows as “Not secure.” With it, the connection protects you from eavesdroppers and from anyone trying to impersonate a trusted site, according to Google’s Transparency Report.
It’s the norm now: in the week of October 11, 2026, 99% of pages opened in Chrome on Android and 95% on Windows were loaded over HTTPS, according to that report; in the United States, 98%.
What is an SSL certificate and what is it for?
An SSL certificate is a digital file installed on a website’s server that does two jobs: it proves to the browser that the site really is the domain in the address bar, and it lets the connection be encrypted. It’s issued by a certificate authority, which browsers trust, after it checks that you control the domain.
Inside are the domain it covers, who issued it, its validity dates and a public key the browser uses to check that the server holds the matching private key. If anything doesn’t add up, it shows a warning.
SSL or TLS?
Same invention, two names. SSL came first, and its last version, SSL 3.0, was retired in 2015 for not being secure enough. Its successor, TLS, saw versions 1.0 and 1.1 retired in March 2021; today sites use TLS 1.2 and TLS 1.3, published in 2018 as RFC 8446. “SSL certificate” is just the old name.
A real certificate, inside and out
| What we checked | What we found |
|---|---|
| Domain covered | vertizeplus.com |
| Issued by | Let’s Encrypt |
| Valid | September 12 to December 11, 2026: 90 days |
| TLS version negotiated | TLS 1.3 |
| TLS 1.0 and 1.1 | Rejected by the server |
We checked it on October 19, 2026 with openssl, a tool that shows a website’s certificate: it had 52 days left. Nobody will renew it by hand: the blog’s host, Vercel, tries to renew it 14 to 30 days ahead, according to its documentation.
How does HTTPS work?
Before sending the page, the browser and the server do a “handshake”: they agree on how to encrypt, work out a key only they know without sending it over the network, and the server presents its certificate. If the browser accepts it, everything from then on travels encrypted.
- The browser says hello and lists the TLS versions and ciphers it understands.
- The server picks, and each side works out the same key on its own.
- The server presents its certificate and proves it holds the private key.
- The browser checks it (domain, dates and issuer), and the encrypted conversation begins.
How long does it take? We measured it on October 19, 2026 from a computer in Ecuador with curl, a program that requests web pages, loading this blog’s home page 10 times. The connection was ready after 76 milliseconds (median) and the handshake finished at 200: encryption added about 120 milliseconds.
A separate test with Node.js measured a 119-millisecond handshake. And it only happens when the connection opens: when we requested two pages in a row over the same one, the second didn’t repeat the handshake.
Does the padlock mean a website is safe?
No. The padlock only says the connection is encrypted and that the certificate matches the domain in the address bar. It says nothing about who’s behind the site or whether they’re honest: the certificate only proves that whoever requested it controls that domain, and a fake site imitating your bank can have one too.
In June 2019, the FBI warned of phishing campaigns on HTTPS websites and advised people not to trust a site just because of the padlock. In 2023, Chrome’s security team wrote that nearly all phishing sites use HTTPS and that, in its own 2021 research, only 11% of participants understood what the padlock means.
That’s why Chrome replaced it in version 117, from September 2023, with a neutral settings icon; pages without HTTPS are still labeled “Not secure.” Always check that the domain is spelled right, especially if you arrived through a link.
How much does an SSL certificate cost?
It can cost nothing. Let’s Encrypt, a nonprofit certificate authority, doesn’t charge for its certificates, and most browsers and operating systems trust them. Some hosts install and renew them automatically; others charge a small fee for managing them, according to Let’s Encrypt itself.
Let’s Encrypt certificates are domain validated (DV): they check that you control the domain and nothing more. Paid ones can be organization validated (OV) or extended validation (EV), which also verify the company, a process that can’t be automated.
That extra check is barely visible anymore: Chrome removed the company name from the address bar in version 77, and Safari made a similar change in 2018, Chrome’s team explains. Our recommendation: a free DV certificate is enough for a business.
What happens if an SSL certificate expires?
Your site is still online, but visitors can’t see it: Chrome shows the “Your connection is not private” warning with the code NET::ERR_CERT_DATE_INVALID, two messages listed on its help page for common errors. According to Chromium’s source code, that code means that, by the device’s clock, the certificate has expired or isn’t valid yet.
If the site uses HSTS, a header that tells the browser to always connect over HTTPS, there’s no way through: the HSTS standard says to end the connection with no option to continue. The same code shows up when the visitor’s clock is wrong, according to Chrome’s help.
And lifetimes keep shrinking. In April 2025, the CA/Browser Forum, where certificate authorities and browsers agree on the rules, approved a schedule to cut them, with votes from Apple, Google, Microsoft and Mozilla. This is how it stands in its Baseline Requirements:
| Issued | Maximum lifetime |
|---|---|
| Before March 15, 2026 | 398 days |
| From March 15, 2026 | 200 days |
| From March 15, 2027 | 100 days |
| From March 15, 2029 | 47 days |
Let’s Encrypt is moving faster: its certificates, valid for 90 days today, will drop to 64 days on February 10, 2027 and to 45 in 2028. So renewing by hand stops being an option: it has to be automatic, and someone must get the alert if it fails.
What changes for your business?
Three things, even if your site doesn’t sell online: what your customers type travels protected, the browser doesn’t flag the site as “Not secure,” and it can be installed as an app. In exchange, someone has to make sure the certificate renews on time.
- Forms and payments. What your customers type, from a phone number to a card, travels encrypted; without HTTPS, someone on the same network could read it.
- The “Not secure” label. Chrome has flagged every HTTP page that way since July 2018, with version 68. And in October 2025 Google announced that Chrome 154 would turn on “Always use secure connections” by default, which asks for permission before opening a public site without HTTPS for the first time.
- Your website as an app. To install on a phone as a PWA, a site has to be served over HTTPS: it’s one of Chrome’s installability requirements.
What gets exaggerated about HTTPS and SSL certificates
- “If it has a padlock, it’s safe.” Only the connection is: phishing sites have one too.
- “SSL is expensive.” There are free certificates that browsers trust; what may cost money is the management.
- “Only online stores need it.” Chrome flags any page without HTTPS as “Not secure.”
- “HTTPS will boost your Google rankings.” In 2014 Google announced it as a very lightweight signal, affecting fewer than 1% of searches. Today its page experience guide says that, apart from Core Web Vitals, aspects like serving pages securely don’t directly help a site rank higher.
What should you check on your website today?
Four quick checks, with nothing to install:
- Type your address with http:// in front and check that it jumps to https:// on its own.
- On a computer, click the icon to the left of the address and open the connection details: you’ll see the issuer and the expiry date.
- Ask whoever manages your hosting whether renewal is automatic and which email gets the alert if it fails.
- If you have forms, bookings or payments, confirm those pages use HTTPS too, not just the home page.
We ran the first check on this blog with curl on October 19, 2026: it answers with a permanent redirect (code 308) to HTTPS and sends the HSTS header, which makes browsers use HTTPS for two years.
The bottom line: your website needs HTTPS and a certificate that renews by itself.
And if you’d rather someone else handled it, the websites we build at Vertize Plus Business go live over HTTPS, with their security padlock.
Frequently asked questions
Does an SSL certificate protect my website from hackers?
No. It protects data while it travels, but it doesn’t stop someone from getting into your site with a weak password or through out-of-date software. For that you need backups and updates.
What should I do if my site shows “Your connection is not private”?
Check whether it happens to everyone or to one device. If it’s one, check its date and time, as Chrome’s help suggests. If it’s everyone, the certificate has most likely expired or doesn’t cover that domain: ask your host to reissue it and keep renewal automatic.