SSL certificate

An SSL certificate is the digital ID card of a website: it confirms that a domain belongs to the server your browser is talking to and enables an encrypted connection over HTTPS. Technically it is a TLS certificate today, because TLS replaced the old SSL protocol long ago, but the name SSL certificate has stuck.

What we measured at 1,914 publishers

As part of our publisher measurement on 11 November 2026 we checked how the homepages of 2,087 active publisher domains from our marketplace catalogue are delivered. 1,914 domains answered, and the result is a very good sign for the websites our customers publish on:

• 99.9% load their homepage over HTTPS, 1,913 of 1,914.
• 94.3% redirect a request for http:// straight to https://.

HTTPS is standard among publishers. The small gap is the redirect: on the remaining sites, the way from http does not lead directly to https. That step belongs in every switch, because links and bookmarks pointing to old http addresses almost always survive. We learned how much redirects matter during our own domain move, when we tested well over 120 of them individually and found chains that reached an error page after two hops. Every old address should reach its new page in a single step.

How an SSL certificate works

1. Connection: your browser requests an https address, and the server sends its certificate with its public key.
2. Check: the browser verifies that the certificate is valid for exactly this domain, that it has not expired and that a trusted certificate authority (CA) has signed it.
3. Encryption: browser and server agree on a shared session key. From then on everything that travels between them is encrypted: forms, passwords, payment data and the pages themselves.

If the check fails, for example because the certificate has expired, the browser shows a full-page warning before the site even loads. That is why it pays to keep an eye on the validity period, which is getting much shorter.

New since March 2026: certificates last 200 days at most

Browser makers and certificate authorities agreed in the CA/Browser Forum in 2025 to shorten the maximum lifetime of public TLS certificates (ballot SC-081):

• since 15 March 2026: 200 days at most, down from 398,
• from 15 March 2027: 100 days at most,
• from 15 March 2029: 47 days at most.

This turns manual renewal into a permanent chore. The answer is automatic renewal through the ACME protocol, which many hosts and platforms offer, for example with free certificates from Let's Encrypt. Check once that renewal runs automatically on your site and set a reminder before the expiry date.

Types of SSL certificates

• DV (domain validation): confirms only that the applicant controls the domain. Issued in minutes, often free and enough for the vast majority of websites.
• OV (organisation validation): also checks that the company exists. The details are in the certificate and visible to anyone who opens them.
• EV (extended validation): the strictest check. The major browsers stopped showing the company name in the address bar in 2019, so the visible advantage has largely gone.

By coverage you can choose single-domain, wildcard for all subdomains on one level (such as *.example.com) and multi-domain certificates. Encryption is equally strong for all types: the only difference is how thoroughly the identity was checked.

Does an SSL certificate affect SEO?

Yes, but only slightly in itself. Google introduced HTTPS as a ranking signal in 2014 and described it as a very lightweight signal that carries less weight than high-quality content. Today Google counts secure delivery as part of page experience, and URL Inspection in Search Console shows HTTPS on its own line. What matters more for SEO is everything around it:

• Trust: browsers mark pages without HTTPS as "Not secure", which puts visitors off, especially in forms and shops.
• Speed: browsers only use the faster HTTP/2 protocol over encrypted connections, which helps page speed.
• Links: a backlink to an old http address only reaches the right page through a working redirect, ideally in a single step.

How to move from HTTP to HTTPS without losing rankings

Google treats a switch from http to https as a site move with URL changes (Google Search Central). These steps keep it clean:

1. Redirect every URL with a 301 from http to its https version in one hop, without chains.
2. Update the signals you control: canonical tags, hreflang, the XML sitemap and internal links should all use https addresses, so Google does not have to follow redirects inside your own site.
3. Remove mixed content: no images, scripts or forms that still load over http.
4. Add the https property in Search Console and submit the new sitemap. The Change of Address tool is not needed for a protocol switch, Google works it out on its own.
5. Optionally add HSTS so that browsers only ever request your site over an encrypted connection.

Expect some ranking fluctuation while Google recrawls the site, and plan a few weeks before everything has settled. A clean URL structure makes the mapping from old to new addresses much easier.

Conclusion

A valid, automatically renewed certificate and a direct redirect from http to https are all a website needs for clean HTTPS, and our measurement shows that almost every publisher we could reach has it in place. If you are looking for suitable publishers for your link building, the Linkbroker marketplace shows Domain Rating, traffic and topics at a glance.

Frequently asked questions

Do I need an SSL certificate if I don't have a shop or forms?

Yes, a blog or a small company site should run on HTTPS too. Without a certificate, browsers warn your visitors, and everything they open on the site could be read in transit.

How do I get a free SSL certificate?

Usually from your host: many activate a free Let's Encrypt certificate with one click and renew it automatically. On your own server, an ACME client such as Certbot handles issuing and renewal.

Why does my browser say "Not secure" even though I have a certificate?

Usually because of mixed content: an image, script or form still loads over http. Other common causes are an expired certificate or one that was not issued for exactly this domain or subdomain.

Is HTTPS a ranking factor?

Yes, but a lightweight one that Google introduced in 2014. Its bigger effect is indirect, through trust, speed and clean redirects.

Related terms: URL structure · Indexing · Duplicate content · Referring domain