SSL

Last updated: August 14, 2026

What is SSL?

SSL, or secure sockets layer, is an encryption-based security protocol that creates a private, authenticated connection between a website's server and a visitor's browser. It protects data such as passwords, payment details, and other personal information as it travels between the two. SSL has since been replaced by transport layer security (TLS), but the name "SSL" stuck, so certificates, categories, and everyday conversation still call it SSL even when TLS is the protocol actually doing the work.

Companies use SSL and TLS certificate software to obtain and manage SSL certificates across their websites, keeping visitor data secure and their domains compliant with current browser standards.

How does SSL work?

SSL works by encrypting data in transit, authenticating the server's identity, and signaling that trust to visitors through HTTPS, all set up in milliseconds through a five-step exchange called the SSL handshake. Think of it as a sealed, signed envelope for web traffic: encryption seals the contents so nobody outside the conversation can read them, the certificate is the signature proving the envelope came from the right server, and the HTTPS padlock is the visible seal showing both checks already passed.

The handshake itself unfolds like this:

1. Client hello: The browser contacts the server and requests a secure connection, sending its supported encryption methods.
2. Server hello and certificate: The server responds with its SSL certificate, which contains its public key and identity information.
3. Certificate verification: The browser checks the certificate against a trusted certificate authority to confirm the server is who it claims to be.
4. Session key exchange: Once verified, the browser generates a session key, encrypts it with the server's public key, and sends it back.
5. Secure session established: The server decrypts the session key with its private key, and both sides use it to encrypt all further data for that browsing session.

SSL certificates protect information such as login credentials, credit card and bank transactions, file transfers, and other personally identifiable information, and they help prevent phishing and other impersonation attacks by confirming a website's identity before any data changes hands.

SSL vs. TLS vs. HTTPS

SSL is the original protocol for encrypting web traffic; TLS is the safer protocol that replaced it; and HTTPS is what a browser displays once either one is working correctly. The IETF formally deprecated SSL after the POODLE vulnerability, but the name stuck, so "SSL" is still used interchangeably with TLS, including in the term "SSL certificate."

What are the types of SSL certificates?

Certificate authorities issue SSL certificates at three main validation levels: domain validation (DV), organization validation (OV), and extended validation (EV).

• Domain validation (DV): Confirms the applicant controls the domain, offering basic encryption with minimal setup and, usually, the lowest cost of the three. DV certificates are common on blogs and personal sites that don't handle sensitive transactions.
• Organization validation (OV): Requires proof of the domain and the business's legal registration, priced above DV but below EV. OV certificates display the organization's name in the browser and suit companies handling everyday customer data.
• Extended validation (EV): Requires the most rigorous identity checks, including business registration, physical location, and operational legitimacy, which makes EV the most expensive tier as well as the most secure. EV certificates are reserved for organizations handling highly sensitive data, such as financial institutions and large e-commerce sites.

Beyond these three validation levels, a handful of certificates cover specific domain setups rather than trust levels: wildcard certificates secure a domain and all of its subdomains under one certificate, multi-domain (SAN) certificates secure several unrelated domains at once, and unified communications certificates (UCC) extend that coverage to email and messaging servers alongside websites.

How do you get an SSL certificate?

Getting an SSL certificate comes down to three technical steps, after deciding which validation level and budget fit the website:

1. Generate a certificate signing request (CSR). This creates a public and private key pair and bundles the website's domain and organization details into a request file.
2. Submit the CSR to a certificate authority for validation. The CA verifies domain ownership for a DV certificate, or additionally verifies business registration for OV and EV certificates.
3. Install the certificate on the server. Once issued, the certificate is installed on the hosting server or web host, activating HTTPS for the domain.

Many web hosts and domain registration providers, along with certificate authorities like Let's Encrypt and Cloudflare, offer free DV certificates that automate most of this process.

Frequently asked questions about SSL

Here are answers to a few common questions about SSL and SSL certificates.

Q1. Do e-commerce websites still need an SSL certificate?

Yes. Any website that collects payment information, login credentials, or other personal data needs an SSL certificate to encrypt that data in transit, and most browsers now flag sites without one as "not secure," which discourages visitors from completing a purchase.

Q2. What happens to a website's SEO if it doesn't have SSL?

A missing SSL certificate doesn't directly penalize a website's rankings, but Google has used HTTPS as a lightweight ranking signal since 2014, and browsers that flag unencrypted sites as "not secure" tend to drive up bounce rates, which can hurt search performance indirectly.

Q3. What causes an SSL handshake failed error?

An SSL handshake failed error almost always comes down to either a certificate problem or a compatibility problem. On the certificate side, the certificate installed on the server may be expired, revoked, or issued for a different domain than the one being requested. On the compatibility side, the browser and server may not support the same TLS version or cipher suite, or the visitor's device clock may be far enough off that certificate validation fails. A firewall or network filter blocking port 443 can stop the handshake before it starts, regardless of whether the certificate itself is fine.

Q4. How do I check if a site's SSL certificate is valid?

Click the padlock icon in the browser's address bar to view the certificate's issuer, validity dates, and the domain it covers. Free online SSL checker tools can also scan a domain and flag expired, misconfigured, or mismatched certificates.

Want the full breakdown of certificate types, providers, and installation steps? Read G2's guide to what an SSL certificate is and why it matters.