On this page
Two things your visitor never sees but always notices
Without a valid SSL certificate, every browser shows your visitor a warning instead of your site. With a valid certificate your address starts with https and the browser shows a padlock. Without one it says http, and since July 2018 Chrome labels the site not secure. When yours expires shows in the SSL checker.
The encryption matters more than it looks. Whatever someone types on your site, from a name in your contact form to a password in your client portal, travels over other people's networks: café wifi, a provider's routers. With https nobody on the way can read it or change the page. The certificate is issued and signed by a certificate authority (CA), an organisation every browser trusts.
SSL 3.0, TLS and the shorter lifetime
- 1996SSL 3.0Netscape fixes the version of SSL dated 18 November 1996 that everything after builds on.
- 1999TLS 1.0In January 1999 the successor gets a new name, Transport Layer Security, based on SSL 3.0.
- 2014HTTPS in GoogleOn 7 August 2014 Google makes https a very lightweight ranking signal.
- 2015SSL 3.0 bannedThe internet standard says in June 2015 that SSL 3.0 must not be used any more.
- 2018TLS 1.3 and not secureTLS 1.3 arrives in August 2018; from July 2018 Chrome 68 marks every http site as not secure.
- 2026Down to 200 daysSince 15 March 2026 a public certificate may be valid for at most 200 days, heading for 47 days in 2029.
SSL is long gone, TLS is not
The SSL protocol has been out of use for years. TLS 1.0 followed SSL 3.0 in 1999, the standards retired SSL 3.0 in 2015 and TLS 1.0 and 1.1 in March 2021. A modern site speaks TLS 1.2 or TLS 1.3, the August 2018 version that sets up a connection faster and drops old, weak ciphers. The name SSL certificate stuck because everyone knows it, and hosts still sell it under that label. An SSL certificate and a TLS certificate are the same thing.
What happens in the first fraction of a second
When someone types your address, their browser asks your server for a secure connection. The server shows its certificate: which domain it covers, who issued it and until when. The browser checks three things: is it signed by a CA it trusts, does the domain match, and is it still valid? Only when all three hold do browser and server agree the keys, through TLS, that encrypt the rest of the session. One failure and the visitor sees a warning instead of your site.
Four steps, and an ever shorter lifetime
- Step 1Browser knocksA visitor types your address. The browser asks your server for a secure connection.
- Step 2Server shows certificateThe certificate states which domain it covers, who issued it and until when.
- Step 3Browser checksSigned by a trusted issuer, right domain, not expired? If not, a warning follows.
Maximum validity of a public certificate
Until 14 March 2026398days
about thirteen months
From 15 March 2026200days
in force now
From 15 March 2027100days
From 15 March 202947days
eight renewals a year
Renewing by hand means doing it eight times a year by 2029. Automatic renewal is the only workable route.
Three levels of checking: DV, OV and EV
Every certificate encrypts equally well. The difference lies in what the CA checks before issuing it.
| Type | What the CA checks | Who it suits | Price per year |
|---|---|---|---|
| DV, domain validation | Only that you control the domain, automatically in minutes | Every business site, online store and blog | Free from Let's Encrypt and from AWS on CloudFront; Sectigo from 110 dollars; Combell from 132.25 euros |
| OV, organisation validation | Also that your company exists and uses the domain | Companies that want their name in the certificate | Combell from 178.25 euros |
| EV, extended validation | A deeper check of company, address and who requests it | Banks and large shops that need it for contracts | Combell from 332.93 euros |
| Wildcard | A DV or OV certificate for all subdomains | Anyone with many subdomains, such as app. and portal. | Combell 258.75 euros; AWS exportable 79 dollars |
Combell is a Belgian host; its prices exclude VAT and are lower in the first year. Let's Encrypt only issues DV certificates and has no plans for OV or EV, because those checks cannot be automated. For a business site, DV is almost always enough.
Free, or a few hundred euros a year
The certificate itself can be free. Let's Encrypt, a nonprofit, charges nothing. If your site runs on Amazon CloudFront, AWS gives you a public certificate at no cost; only a certificate you export to another server is billed, at 7 dollars per domain or 79 dollars for a wildcard. A paid DV certificate bought directly from Sectigo starts at 110 dollars a year.
The real cost is time. A certificate has to be installed, renewed and monitored, and that gets more frequent every year. If you are comparing agencies, ask who renews it and how; our overview of digital agency costs shows what else belongs in a running website budget.
200 days now, 47 by 2029
The CA/Browser Forum, where certificate authorities and browser makers agree the rules, adopted a schedule in 2025 that cuts maximum validity step by step. Until 14 March 2026 it was 398 days. Since 15 March 2026 it is 200 days, from 15 March 2027 it becomes 100 days and from 15 March 2029 47 days. Let's Encrypt follows with 64 days from 10 February 2027 and 45 days from 16 February 2028.
Say a parts wholesaler in Rotterdam pays its host for a one-year certificate that someone in the office installs by hand. Until March 2026 that was a yearly chore. With 200 days it happens twice a year, from 2027 four times, and from 2029 eight times: 365 divided by 47 is 7.8. One forgotten renewal and the site shows a warning to every buyer. Switch to automatic renewal, through Let's Encrypt or your host's own certificates, and it costs nothing and needs no reminder.
Expired: what your visitor gets to see
Not a small icon but a full-page warning, in Chrome with the error code NET::ERR_CERT_DATE_INVALID. Most visitors leave, forms stop arriving and paid ads send people straight to the warning. Renew the certificate, check that automatic renewal runs again, and test the site on a phone and a computer.
HTTPS, the GDPR and Google
No EU law says in so many words that you need an SSL certificate. The GDPR does ask, in article 32, for appropriate security of personal data and names encryption as an example. A contact form that sends names and phone numbers over plain http is hard to square with that. What your site must tell visitors about their data is in do I need a privacy policy?; with the supplier that processes your forms you sign a data processing agreement. If you or your customer fall under NIS2, encryption is one of the measures you must be able to show.
For Google, https has been a very lightweight ranking signal since 2014, weighing less than good content. It will not lift your SEO on its own, but without it you lose visitors to the warning. When you move from http to https, send every old address on with a 301 redirect so your rankings move along. How that works when you change host is covered in moving a website to a new host.
About prices, padlocks and expiry
Is an SSL certificate required by law?
Not literally. The GDPR asks for appropriate security of personal data with encryption as an example, and every browser flags a site without https as not secure. For a site with a form, a login or a shop it is a must in practice.
What is the difference between SSL and TLS?
TLS has been the successor of SSL since 1999, and SSL 3.0 has been banned since 2015. What is sold as an SSL certificate today is used with TLS 1.2 or 1.3; the old name simply stuck.
How long is an SSL certificate valid?
Since 15 March 2026 for at most 200 days. From 15 March 2027 that becomes 100 days and from 15 March 2029 47 days. A Let's Encrypt certificate lasts 90 days by default, dropping to 64 and later 45 days.
Do I need a wildcard certificate?
Only with many subdomains, such as app., portal. and mail. on the same domain. A standard certificate covers your domain with and without www. With automatic certificates per subdomain you can do without a wildcard.