Secure Sockets Layer (SSL) is an encryption protocol establishing a secure connection between client (e.g. browser) and server. The original SSL specification from the 1990s was long ago superseded by its successor TLS (Transport Layer Security), but in common parlance the term “SSL” has stuck. When someone speaks of an “SSL certificate” today, they de facto mean a TLS certificate. An SSL/TLS-encrypted connection is recognisable by the https:// in the address bar and the lock symbol in front of it, and it’s no longer optional today: browsers mark http:// pages as “not secure”, Google ranks unencrypted pages worse and GDPR-compliant hosting demands it anyway.
What is SSL/TLS needed for?
Three central protection goals are achieved with SSL/TLS at once:
- Confidentiality: the data transfer is encrypted – an eavesdropper on the network (public Wi-Fi, ISP, MITM) can’t read the content
- Integrity: the data can’t be manipulated unnoticed along the way (hash protection per packet)
- Authenticity: the server identifies itself via its certificate – the client knows which counterpart it’s communicating with
Without these protection goals, online banking, login forms, payment processes and confidential contact forms would simply be impossible.
The TLS handshake (simplified)
When a browser opens an https:// URL, a TLS handshake runs in the background establishing the secure connection:
- Client hello: the browser sends its supported TLS versions and cipher suites
- Server hello: the server picks a cipher suite and sends its certificate
- Certificate check: the browser verifies the chain of trust against its built-in root CAs and the expiry date
- Key exchange: a symmetric session key is generated via Diffie-Hellman / ECDHE
- The encrypted connection stands: all further data runs encrypted
The modern version TLS 1.3 drastically reduces the number of round trips (1-RTT, in special cases 0-RTT) – a clearly measurable performance gain over TLS 1.2.
Certificate types
Not every SSL/TLS certificate is equal. Three validation tiers are relevant today:
| Type | What is checked? | Typical field of use |
|---|---|---|
| DV (domain validation) | Control of the domain (email or DNS challenge) | Standard websites, blogs, small shops |
| OV (organisation validation) | Domain + company (commercial register, phone callback) | Company websites, B2B portals |
| EV (extended validation) | Strict identity verification per CA/Browser Forum rules | Banks, insurers, large e-commerce sites |
The formerly visible green EV bar in the browser line has almost everywhere disappeared – modern browsers show only the lock symbol. The DV/OV/EV difference is today primarily a trust and compliance question, no longer a UX advantage.
Single, wildcard, SAN
- A single-domain certificate: valid for one hostname, e.g. only
www.example.com - A wildcard certificate: valid for a domain and all subdomains (
*.example.com) - A SAN or multi-domain certificate: covers several concretely defined domains (
example.com,example.de,another-domain.com)
Let’s Encrypt
Let’s Encrypt is a free certificate authority issuing DV certificates automatically. Via tools like Certbot, renewals every 90 days can be handled by script. For most standard web projects, Let’s Encrypt is today the obvious choice – free, widespread and integrated into almost every web hosting package.
HTTPS, HSTS and a secure migration
If you migrate an existing website from HTTP to HTTPS, set up in addition to SSL/TLS:
- A 301 redirect from
http://tohttps://for every URL (not just the homepage) - The
Strict-Transport-Securityheader (HSTS): tells browsers to reach a domain only via HTTPS in future – protects against downgrade attacks - A mixed-content cleanup: switch all internal resources (images, scripts, stylesheets) to
https://URLs - Canonical tags: point them to the
https://variant - Sitemap and robots: rewrite the sitemap completely to
https://and resubmit it to Google Search Console
From an SEO perspective, HTTPS has been an official, if light, ranking signal since 2014. From a trust and GDPR perspective, it’s long been mandatory.
Frequently asked questions about SSL/TLS
What’s the difference between SSL and TLS? TLS is the modern, secure evolution of SSL. The last real SSL versions (SSL 3.0) have been considered insecure since 2014 and are disabled in every current browser. Today’s “SSL certificates” are de facto always TLS certificates.
Do I strictly need SSL for my website?
In practice, yes. Browsers warn on http:// forms, Google lightly punishes unencrypted pages in the ranking, and the GDPR demands the “state of the art” for transmitting personal data – HTTPS is exactly that today.
How much does an SSL certificate cost? With Let’s Encrypt, nothing. For OV/EV certificates, prices range in the two- to three-digit euro range per year depending on CA and term.
Does SSL/TLS slow down my website? In modern TLS 1.3 setups, practically not – the handshake latency is in the single-digit millisecond range. Common optimisations like OCSP stapling and session resumption reduce the effort further.
How long is a certificate valid? At most 398 days (set by the CA/Browser Forum). Let’s Encrypt certificates run 90 days and are usually renewed automatically.
What does the lock symbol in the browser mean concretely? It confirms: the connection is encrypted and the certificate belongs to the domain. It does not say the website is reputable – phishing sites today almost always have a valid Let’s Encrypt certificate too.
Conclusion
SSL/TLS is today no security add-on but the basic equipment of every website. The question isn’t whether but which certificate tier and how cleanly the migration runs, including HSTS, clean redirects and a mixed-content cleanup. We securely set up SSL certificates incl. automatic renewal in every hosting and relaunch project. Feel free to reach out for a no-obligation consultation.