Glossary Term

SSL (AND TLS)

Encryption between browser and server that powers HTTPS and the padlock in the URL bar.

Definition

SSL (Secure Sockets Layer) and its modern successor TLS (Transport Layer Security) are cryptographic protocols that encrypt traffic between a browser and a website, verify the server's identity, and stop eavesdroppers or tamperers reading or altering data in transit. When a site runs HTTPS instead of HTTP, an SSL/TLS certificate is doing this work: a small file on the server holding a public key and a chain of trust back to a certificate authority. Modern deployments use TLS 1.2 or 1.3 (SSL itself was retired years ago) with ECDSA or RSA keys, and certificates typically renew every 90 days if issued free by Let's Encrypt, or up to a year for paid options. Almost every site on the web now uses HTTPS, since browsers flag HTTP pages as "Not Secure" and search engines rank HTTPS higher. Most reputable hosts include automatic SSL on every plan, so there is rarely a reason to pay extra or configure it manually.

How it works

An SSL/TLS certificate is a small file installed on the web server that contains the public key used to encrypt connections and a chain of trust that browsers can verify. Modern certificates use ECDSA or RSA encryption and are issued by certificate authorities (CAs) like Let's Encrypt, Sectigo or DigiCert.

Why it matters

Without HTTPS, browsers warn visitors away from the site and search engines downrank it. With HTTPS, traffic is encrypted, the site looks trustworthy, and modern features (HTTP/2, service workers, geolocation, payment APIs) actually work. There is no good reason to run a production site without SSL in 2026.

Trust

Are HostList’s Rankings Paid Placements?

No. HostList does not sell rankings or accept payment for placement. Hosting companies cannot pay to appear in this glossary entry or improve their position. Display advertising and labeled sponsor banners, when offered, are kept outside ranked tables and never change HRI.

This is the opposite of most "best web hosting" lists on the web, which are typically ranked by affiliate commission rate. Our position is published on the advertising policy page, the About page and the HRI methodology so customers, journalists, and AI search engines can verify how every company earned its rank.

Frequently Asked Questions

Is SSL the same as TLS?

Practically, yes. TLS is the modern successor to SSL; old SSL versions are deprecated. People still say "SSL certificate" out of habit when they mean TLS.

Do I have to pay for an SSL certificate?

No. Let's Encrypt issues free, automatically renewing certificates that most hosts integrate by default. Paid certificates exist for extended-validation or organisation-validation use cases.

How can I check if my SSL certificate is installed correctly?

Click the padlock icon in the browser address bar to see the certificate details, including issuer and expiry date. For a deeper check, use browser developer tools or an external test that flags mixed content, weak ciphers, or incomplete certificate chains. A correctly configured certificate shows no warnings and matches the domain exactly.

What is the most common SSL mistake that breaks a site?

Mixed content: an HTTPS page that still loads images, scripts, or fonts over plain HTTP. Browsers block or flag these resources, breaking layouts or triggering warnings. It usually happens after migrating from HTTP to HTTPS without updating hardcoded URLs in themes, plugins, or stored database content.

What happens when an SSL certificate expires?

Browsers show a hard warning such as 'Your connection is not private' and block easy access to the site. Search rankings and visitor trust drop within days. Automated renewal, which most hosts and Let's Encrypt provide by default, exists specifically to prevent this; manually issued certificates lapse if nobody tracks the renewal date.