{"id":284,"date":"2021-04-13T05:30:00","date_gmt":"2021-04-13T09:30:00","guid":{"rendered":"https:\/\/www.inmotionhosting.com\/support\/2011\/11\/02\/what-is-ssl-and-why-is-it-important\/"},"modified":"2026-04-22T13:50:51","modified_gmt":"2026-04-22T17:50:51","slug":"what-is-ssl-and-why-is-it-important","status":"publish","type":"post","link":"https:\/\/www.inmotionhosting.com\/support\/website\/ssl\/what-is-ssl-and-why-is-it-important\/","title":{"rendered":"What Is SSL and Why Does It Matter for Your Website?"},"content":{"rendered":"
\"\"<\/figure>\n\n\n\n

An SSL certificate encrypts traffic between a visitor\u2019s browser and your web server, so passwords, payment details, and form submissions cannot be read by anyone watching the connection. This guide explains what SSL actually is today, how the handshake works, the difference between free and paid certificates, and what to configure after installation so your site loads without mixed content warnings.<\/p>\n\n\n\n

What Is an SSL Certificate?<\/h2>\n\n\n\n

An SSL certificate is a data file issued by a certificate authority that binds a cryptographic key pair to your domain and proves your server is who it claims to be. Once installed, it lets your server negotiate an encrypted session with a visitor\u2019s browser so the rest of the conversation is unreadable to anyone sitting between them.<\/p>\n\n\n\n

The name is mildly misleading. Original SSL (Secure Sockets Layer)<\/strong> was designed by Netscape in the mid-1990s and was fully deprecated by the IETF in 2015<\/a>. What your \u201cSSL certificate\u201d actually does today is enable TLS (Transport Layer Security)<\/strong>, the successor protocol. TLS 1.2 and TLS 1.3<\/a> are the current standards. The industry still calls the certificates \u201cSSL certificates\u201d because the habit stuck, but the wire protocol is TLS.<\/p>\n\n\n\n

One certificate, one responsibility: prove your domain\u2019s identity and hand the browser a public key to start an encrypted session.<\/p>\n\n\n\n

How Does the SSL\/TLS Handshake Actually Work?<\/h2>\n\n\n\n

When a visitor types https:\/\/yoursite.com<\/code>, a short negotiation happens before any page content moves:<\/p>\n\n\n\n

    \n
  1. The browser sends a ClientHello with the TLS versions and cipher suites it supports.<\/li>\n\n\n\n
  2. Your server replies with a ServerHello, its chosen cipher, and its certificate.<\/li>\n\n\n\n
  3. The browser validates the certificate chain against its trusted root store. If anything is expired, self-signed, or mismatched, the connection aborts with a warning.<\/li>\n\n\n\n
  4. The two sides exchange key material using Diffie-Hellman (or ECDHE in TLS 1.3) and derive a shared symmetric session key.<\/li>\n\n\n\n
  5. From that point on, every request and response is encrypted with that session key.<\/li>\n<\/ol>\n\n\n\n

    TLS 1.3 compresses this into a single round trip<\/a>, which shaves roughly 100 milliseconds off the initial connection compared with TLS 1.2. That sounds small until you remember the handshake runs on every cold connection, and over mobile networks the latency is noticeable on first paint.<\/p>\n\n\n\n

    \"Infographic<\/figure>\n\n\n\n
    <\/div>\n\n\n\n

    How Can You Tell if a Site Is Using SSL?<\/h2>\n\n\n\n

    Three quick checks tell you whether a connection is encrypted:<\/p>\n\n\n\n