{"id":1292,"date":"2026-09-22T17:44:05","date_gmt":"2026-09-22T17:44:05","guid":{"rendered":"https:\/\/netloria.com\/blog\/what-is-an-ssl-certificate-en\/"},"modified":"2026-10-05T09:36:12","modified_gmt":"2026-10-05T09:36:12","slug":"what-is-an-ssl-certificate-en","status":"publish","type":"post","link":"https:\/\/netloria.com\/en\/blog-en\/what-is-an-ssl-certificate-en\/","title":{"rendered":"What Is an SSL Certificate and Why You Need One"},"content":{"rendered":"

What an SSL Certificate Is and Why Your Site Needs One<\/h1>\n

\"SSL<\/p>\n

In late 2026, millions of websites will suddenly get a red flag in the browser \u2014 and their owners will hear about it from confused customers rather than from any dashboard. The reason will be the same in almost every case: a missing or misconfigured SSL certificate.<\/p>\n

Google has already confirmed that with Chrome 154, which becomes the default for all users in October 2026<\/a>, the browser will ask for confirmation before opening any public site that does not support HTTPS. Earlier, from Chrome 147 in April 2026, this was switched on for over a billion users with Enhanced Safe Browsing. So the “this site is not secure” screen is about to be seen not by a technician in the settings menu, but by an ordinary visitor \u2014 a second before they decide not to buy from you after all.<\/p>\n

Let’s break it down without jargon: what this certificate actually is, what it really does, how much it costs (often nothing) and how to tell when something is wrong with yours.<\/p>\n

What an SSL certificate actually does<\/h2>\n

When a visitor fills in a form on your site \u2014 name, phone number, card details \u2014 that data travels from their device to your server through dozens of intermediate points. Without encryption, anyone along that path, from the admin of a caf\u00e9’s public Wi-Fi to an internet provider, can read it in plain text.<\/p>\n

An SSL certificate (technically TLS now, but the old name stuck) does two things. It encrypts that stream, turning the data into an unreadable set of characters for everyone except the destination server. And it confirms that the site the visitor opened really is yours, not a phishing copy that stole your design and logo.<\/p>\n

Technically, the certificate is a small file issued by a trusted Certificate Authority and installed on the server. During the connection, the browser checks that file: who issued it, to whom, whether it has expired, whether it has been revoked. If everything checks out, you get the padlock and an https:\/\/<\/code> address. If not, a warning.<\/p>\n

The key word here is “trusted.” Browsers keep a list of certificate authorities they trust by default. A certificate from such an authority is accepted silently; one you generated for yourself is not, even if the encryption underneath is technically identical. So the whole point of SSL is not only the maths of encryption but also the chain of trust: someone authoritative vouches that the site at this address is genuinely who it claims to be.<\/p>\n

HTTP or HTTPS: one letter everyone sees<\/h2>\n

The difference between http:\/\/<\/code> and https:\/\/<\/code> is literally that trailing “s” for “secure.” But the consequences of that letter are visible to the visitor straight away.<\/p>\n

On a secure site there is a neutral padlock next to the address. On an insecure one, Chrome has long shown a grey “Not secure” label, and soon it will show a full-screen warning with a confirmation button. Picture someone clicking your Instagram ad and, instead of the product page, hitting a screen that reads “Attackers might be trying to steal your information.” How many of them press “Continue anyway”?<\/p>\n

At Netloria we have more than once watched a business owner blame a drop in leads on “the season” or “the algorithm” for weeks, while the cause sat right there in the address bar \u2014 the site served content over HTTP, and half of the visitors turned around at the very first screen.<\/p>\n

Why HTTPS is no longer optional<\/h2>\n

A decade ago, encryption was considered necessary only for banks and online stores. Now it is the standard for the entire web, and the numbers confirm it. According to Google, the share of pages loaded over HTTPS in Chrome grew from roughly 30\u201345% in 2015 to around 95\u201399% by 2020<\/a> \u2014 and has held at that level since. On Windows it is about 95%, on Android and Mac over 99%, on ChromeOS close to 100%.<\/p>\n

So a site without HTTPS today is that rare exception the browser deliberately draws attention to. And three separate reasons to switch are at work here, not one.<\/p>\n

Visitor trust.<\/strong> The padlock and a clean address are things people have learned to notice, mostly without thinking. A “Not secure” label on a checkout page kills conversion more effectively than any typo in your copy.<\/p>\n

Search rankings.<\/strong> Google has officially used HTTPS as a ranking signal<\/a> since 2014. On its own it is a light one \u2014 moving to HTTPS will not rocket you to the top. But all else being equal, a secure site has an edge over an insecure competitor, and that is exactly the position most small businesses find themselves in on the results page.<\/p>\n

Technical capabilities.<\/strong> Many modern browser features \u2014 geolocation, push notifications, service workers for offline mode, correct behaviour of payment forms \u2014 simply refuse to work over an unencrypted connection. Without HTTPS you are cutting off part of your toolkit before you have even thought of using it.<\/p>\n

Types of SSL certificate: DV, OV and EV<\/h2>\n

When it comes to choosing, it turns out that “SSL certificate” is not one product but three levels of validation. They differ not in the strength of encryption \u2014 that is the same \u2014 but in what exactly the authority checks before issuing.<\/p>\n\n\n\n\n\n\n
Type<\/th>\nWhat is verified<\/th>\nIssuing speed<\/th>\nWho it suits<\/th>\n<\/tr>\n
DV<\/strong> (Domain Validation)<\/td>\nOnly that you control the domain<\/td>\nMinutes, automatic<\/td>\nBlogs, landing pages, most small-business sites<\/td>\n<\/tr>\n
OV<\/strong> (Organization Validation)<\/td>\nDomain plus the real existence of the company<\/td>\nHours to a few days<\/td>\nCorporate sites where legal transparency matters<\/td>\n<\/tr>\n
EV<\/strong> (Extended Validation)<\/td>\nIn-depth organisation check under a strict procedure<\/td>\nSeveral days, with documents<\/td>\nBanks, large stores, fintech<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Here is a detail that sellers of expensive certificates stay quiet about: EV once showed a green bar with the company name in the address, and that was precisely how it was sold. Modern browsers have removed that green bar. To a visitor, DV, OV and EV now look identical \u2014 the same padlock. So paying extra for EV only makes sense where there are real regulatory or internal requirements, not for a “trust effect” the user no longer sees.<\/p>\n

How much SSL costs \u2014 and why it is often zero<\/h2>\n

Another question where businesses lose money for no reason. SSL is often sold as a separate paid service for a few hundred a year \u2014 even though in the vast majority of cases it is already free.<\/p>\n

The non-profit authority Let’s Encrypt issues DV certificates for free, automatically, to anyone. They are valid for 90 days and renew themselves, with no human involved. A huge share of the modern web runs on Let’s Encrypt.<\/p>\n

In practice this means the following.<\/p>\n