SSL encryption (Secure Sockets Layer) secures the connection between a server and a client by encrypting it. This ensures that third parties cannot intercept the data. Typically, this encryption is implemented via the HTTPS protocol. SSL encryption has become a significant factor for Google's ranking. A more advanced encryption method is TLS (Transport Layer Security).
When a URL is accessed via HTTPS, the data exchange between the browser and the domain is encrypted on the web server. To initiate this encryption, the browser first retrieves specific data. The client then verifies the server and domain's authenticity by obtaining an SSL certificate, which validates the connection between the web server and the domain.
SSL certificates are issued by "Certification Authorities" (CA). Website operators must request these certificates, which are then reviewed along with the site's relevant information. The CA issues the certificate, allowing it to be downloaded by clients when they access the site.
Encryption is achieved by securing data with a public key. Only the private key on the web server can decipher the information exchanged between the server and client, ensuring that third parties cannot access the connection.
If an encrypted connection cannot be established, the SSL protocol is disabled. Users can identify an SSL-encrypted connection by the presence of HTTPS at the beginning of the web address, indicating the conventional HTTP protocol is encrypted.
The CA Security Council (CASC) promotes data security and authorizes various providers to distribute SSL certificates. Notable providers include Thawte, GeoTrust, and GlobalSign, with Let's Encrypt being a well-known provider of free certificates.
To acquire a publicly usable certificate, the website must be publicly accessible, meaning intranet connections require alternative solutions. SSL encryptions can cover a single domain or multiple domains (SAN certificates). Website operators must select the appropriate version, and certificates typically last a year, with fees payable to the CA.
Webmasters have various SSL certificates to choose from, categorized by encryption or trust level, increasing in security:
This basic SSL key, or "DV certificate," records and publicly displays a website's fundamental data. Often used by private or small websites, this form of encryption secures the data connection but doesn't guarantee issuance to a specific company. It's common when many websites share a server without a dedicated server, securing only up to an HTTPS proxy server.
OV certificates are issued following a detailed company review. Website visitors can view this data to verify the site's trustworthiness.
EV SSL certificates are granted based on stringent criteria. They examine both the website and the company's data security, reassuring users that all connections with the company's domain are SSL-encrypted.
To set up SSL encryption, the purchased SSL certificate must be integrated into the server. After uploading the certificate, webmasters can configure the server settings to encrypt a domain, subdomain, or multiple domains, depending on the certificate type. The configuration is typically straightforward with web hosting software.
Finally, SSL encryptions should be tested across various clients like Google Chrome, Firefox, or Microsoft Edge. Using SSL checkers is also advisable.
Since 2014, SSL encryption has impacted Google's ranking. The search engine itself has been HTTPS-protected since 2011. Today, Google displays whether a website supports HTTPS in search results.
In 2017, Searchmetrics analyzed HTTPS adoption in Google search results. In finance, 29% of URLs were encrypted, with e-commerce at 12%, media at 12%, health at 19%, and travel at 23%.