Data breaches and cyber-attacks are common enough now that secure communication over the internet is not something a site can treat as optional. SSL (Secure Sockets Layer) encryption is how that gets handled.
What is SSL encryption?
SSL is a security technology that creates an encrypted link between a web server and a browser. Everything passing over that link stays private and arrives intact.
Historical context
Netscape developed SSL in the 1990s and it has been revised several times since. The current protocol is TLS (Transport Layer Security). Almost everyone still calls it SSL.
How does SSL encryption work?
Two processes: the handshake, then the encrypted data transfer.
The SSL handshake
- Your browser asks the server to identify itself.
- The server sends a copy of its SSL certificate, which includes its public key.
- Your browser checks that certificate against its list of trusted certificate authorities.
- The two sides also run a key exchange. In modern TLS each side sends a public Diffie-Hellman share and derives the shared secret independently, so the secret itself never travels over the wire. Older TLS could instead have the browser encrypt a premaster secret with the server’s public key; TLS 1.3 removed that mode.
- Both sides confirm the handshake and switch to keys derived from that exchange. The encrypted session is now open.
Data encryption
From that point on, everything transmitted is encrypted with the session key. Intercepted traffic is unreadable without it.
Why is SSL encryption important?
- It keeps credit card numbers, login credentials and personal information from being read in transit.
- It confirms you are talking to the site you intended rather than an imitation of it.
- Browsers have deliberately retired the padlock (Chrome replaced it in 2023) precisely because users read it as a verdict on the site rather than the connection. The operative signal today is the “Not secure” warning on plain HTTP.
- Google has treated HTTPS as a lightweight ranking signal since 2014, effectively a tie-breaker, and with HTTPS now near-universal it differentiates little. The security argument carries the decision on its own.
Types of SSL certificates
- Domain Validated (DV): the certificate authority verifies only that you control the domain. Encryption strength is identical across all three types; what differs is the identity vetting.
- Organization Validated (OV): adds authentication of the business behind the domain.
- Extended Validation (EV): the deepest vetting, with the certificate authority examining the business itself. Browsers removed the EV name-in-address-bar indicator in 2019, so EV no longer buys a visible trust signal.
Implementing SSL
Pick the certificate type that matches what the site actually does. Keep it current, because an expired certificate produces a browser warning and visitors leave rather than click through it. Prefer TLS 1.3, with TLS 1.2 as the floor; 1.0 and 1.1 are formally deprecated. Turn on HTTP Strict Transport Security (HSTS) so browsers will only connect to you over HTTPS.
Further reading
For implementation detail, the useful sources are Let’s Encrypt, SSL Labs, and the OpenSSL Project.