SSL Certificate

An SSL certificate is the file that lets your server prove its identity and encrypt traffic over HTTPS. If it's missing, expired, or misconfigured, browsers slap a "Not secure" warning on your pages, Chrome interstitials scare visitors away, and Google quietly counts HTTPS against you as a ranking signal you're not earning.

Pedantry corner: the protocol has been TLS since 2008, but everyone still says "SSL certificate," including the certificate vendors. Nobody will correct you in a meeting, and this page won't either.

What actually breaks when the certificate is wrong

The SEO damage from certificate problems is almost never "Google penalized my HTTPS." It's downstream mechanics:

• An expired certificate takes the page offline for real users. Browsers show a full-screen warning most people won't click through. Googlebot can still fetch the page, but your click-through and conversion data crater, and word gets around.
• A certificate that doesn't cover the hostname (say, it covers example.com but not shop.example.com) produces the same warning on that subdomain only, which is why these bugs survive for months — nobody on the team browses the affected host.
• A botched HTTPS setup splits your site in two. If HTTP versions keep resolving with 200s instead of redirecting, you have duplicate URLs competing with each other. See URL works on HTTP and HTTPS for how that split plays out in the index.

A real check: openssl instead of guessing

The fastest way to see exactly what certificate a server presents, without trusting whatever your browser has cached:

openssl s_client -connect seoprocheck.com:443 -servername seoprocheck.com </dev/null 2>/dev/null 
  | openssl x509 -noout -subject -issuer -dates

subject=CN=seoprocheck.com
issuer=C=US, O=Let's Encrypt, CN=R11
notBefore=May 12 03:14:07 2026 GMT
notAfter=Aug 10 03:14:06 2026 GMT

Three things to read off that output: the CN (plus SANs, add -ext subjectAltName) must cover the hostname users actually visit, the issuer tells you who signed it, and notAfter is your expiry date. The -servername flag matters — servers hosting multiple sites pick the certificate based on it (SNI), so without the flag you may be inspecting the wrong cert entirely.

To check every subdomain in one pass, loop it:

for h in www shop blog api; do
  echo -n "$h: "
  openssl s_client -connect $h.example.com:443 -servername $h.example.com </dev/null 2>/dev/null 
    | openssl x509 -noout -enddate
done

Certificate types and what actually matters for SEO

Certificate vendors love to upsell validation tiers. Here's the honest mapping:

The takeaway most audits get wrong: validation level is a paperwork distinction, not a ranking factor. Google's HTTPS signal checks that the connection is secure, not who signed the cert or what you paid.

How to check it on your own site

1. Run the openssl s_client command above against your apex domain, www, and every subdomain that serves content. Note expiry dates and hostname coverage.
2. Run your domain through Qualys SSL Labs (ssllabs.com/ssltest). Anything below grade B usually means an incomplete chain or ancient TLS versions — the incomplete chain is the sneaky one, because desktop browsers fill in missing intermediates but some crawlers and older Android builds don't.
3. Test curl -sI http://example.com/some-page — every HTTP URL should answer 301 straight to its HTTPS twin. If it returns 200, fix it with a server-level redirect; the walkthrough is in HTTP does not redirect to HTTPS.
4. Crawl the site with Screaming Frog and check the Security tab for mixed content — HTTPS pages pulling images or scripts over plain HTTP. Browsers block the worst of it and warn on the rest; the fix patterns are in the mixed content guide.
5. Put expiry monitoring somewhere that pages a human. Certbot renewals fail silently more often than anyone admits — a cron job that emails when notAfter is under 21 days out costs five minutes to write.

Common audit mistakes

• Recommending an EV certificate "for trust signals." Users literally cannot see EV status in any current browser. Recommend DV and spend the budget on something measurable.
• Checking only the homepage. Certificates are per-hostname. Audit every subdomain that appears in your sitemaps, hreflang sets, or canonical tags.
• Ignoring the certificate chain. "Works in Chrome" is not a pass — Chrome repairs incomplete chains on the fly. SSL Labs flags "chain issues: incomplete"; fix the server config, don't shrug.
• Treating HTTPS migration as done once the cert installs. Redirects, canonicals, internal links, sitemap URLs, and hreflang all have to move too. The full sequence is in the HTTPS migration technical checklist.
• Setting HSTS with a long max-age on day one. If anything on the HTTPS side is broken, HSTS makes it unreachable for every returning visitor until the timer expires. Start with a short max-age, extend after a clean week.

FAQ

Does a paid certificate rank better than a free one?

No. Googlebot validates that the connection is encrypted and the certificate is trusted and current. Let's Encrypt satisfies that exactly as well as a $400 EV cert.

What happens to rankings if my certificate expires for a day?

Usually nothing dramatic from a single short lapse — Google retries. The real damage is user-facing: near-zero clickthrough while the interstitial is up, and repeated lapses can get pages temporarily dropped as unreachable.

Do I need a certificate on a site that has no forms or logins?

Yes. Browsers mark all HTTP pages "Not secure" regardless of content, HTTPS is a ranking signal regardless of content, and referral data from HTTPS sites to your HTTP site gets stripped, so your analytics lie to you on top of everything else.

Wildcard or individual certificates for subdomains?

Operationally, wildcard — one renewal to monitor instead of ten. There's no SEO difference; the only caveat is that a wildcard covers one level (*.example.com does not cover a.b.example.com).

Does TLS version affect SEO?

Only at the extremes. TLS 1.0/1.1 trigger browser warnings, which is the same user-trust problem as no certificate. TLS 1.2 is fine; 1.3 is a minor speed win on handshakes, not a ranking lever.