Do you need an SSL certificate? What the padlock means for your business

A potential customer clicks through to your website from Google. Before they read a word about your services, the address bar tells them your site is "Not secure". Some will carry on. Many will press the back button and choose the next business on the list.

That label is about one thing: whether your website uses HTTPS, which depends on what most people still call an SSL certificate. The short answer to the question in the title is yes, every business website needs one. The more useful answer is understanding what it does, what it does not do, and how to stop it from quietly expiring.

SSL, TLS and HTTPS in plain words

SSL stands for Secure Sockets Layer. It was the original technology for creating an encrypted connection between a visitor's browser and a website. It has since been replaced by TLS (Transport Layer Security). The last version of SSL was formally deprecated in 2015, and even the early versions of TLS were retired in 2021.

The name stuck, though. When a hosting company sells or installs an "SSL certificate" today, it is really a TLS certificate. You will see both terms used for the same thing.

HTTPS is what you see in the result. When a website has a valid certificate installed and is set up to use it, its address starts with https:// and the connection between the visitor and your website is encrypted.

What HTTPS protects, and what it does not

What it protects

Google's web developer guidance describes two main jobs:

• Privacy. Nobody between your visitor and your website, for example on a public Wi-Fi network, can read what is being sent. That includes contact form entries, login details and order information.
• Integrity. Nobody along the way can change the page or slip their own content into it before it reaches your visitor.

Google's advice is to use HTTPS on every website, even one that does not handle sensitive information. Some newer browser features, such as access to a visitor's camera or microphone, only work on HTTPS pages.

What it does not do

This is where many businesses are misled. HTTPS protects the connection, not the website itself.

• It does not stop your website from being hacked. A site with weak passwords or outdated plugins can be broken into whether it uses HTTPS or not.
• It does not prove a business is legitimate. Google's Chrome team has said plainly that the padlock does not indicate that a website is trustworthy, and that nearly all phishing sites use HTTPS too. Its own research found that only 11% of people correctly understood what the padlock meant. Partly for this reason, Chrome replaced the padlock on secure pages with a neutral settings-style icon in 2023.

HTTPS is one item on a longer list. For the rest, from updates and logins to backups and your responsibilities under POPIA, see Business website security: what every South African SME should have in place.

What your visitors see in Chrome

The original version of this article said that visitors would see an error message before reaching a site without HTTPS. That was not accurate at the time. Here is what Google has actually announced and introduced:

• Since July 2018 (Chrome 68), Chrome has labelled every page without HTTPS as "Not secure" in the address bar.
• Since October 2018 (Chrome 70), that label turns red when someone starts typing into a form on a page without HTTPS, which is exactly when you are asking a potential customer for their details.
• Since late 2020, if a secure page sends its form to an insecure address, Chrome warns the visitor while they fill it in, shows a full-page warning when they try to submit it and switches off autofill.
• From Chrome 154, scheduled for October 2026, Google plans to switch on the "Always use secure connections" setting by default. Chrome will then ask visitors for permission before opening a public website without HTTPS that they have not visited recently. They can still choose to continue.

Does HTTPS help with Google rankings?

A little. In 2014 Google announced that it would use HTTPS as a ranking signal, but described it as a very lightweight one that carries less weight than signals such as high-quality content.

Google's current page experience guidance still asks whether your pages are served securely, while making it clear that relevant, helpful content comes first. Treat HTTPS as a basic requirement rather than an SEO strategy. The bigger benefit is that visitors are not put off before they reach your content.

Which type of certificate do you need?

All certificates encrypt the connection. They differ in how much the issuer checks before issuing one.

• Domain validated (DV). Confirms only that whoever requested the certificate controls the domain name. It says nothing about who runs the business. This is the right choice for most business websites.
• Organisation validated (OV). Also checks that the organisation legally exists. Visitors can see the verified company name if they open the certificate details.
• Extended validation (EV). The most thorough checks and the slowest to issue. Chrome used to show an EV badge beside the address bar, but moved it into a secondary menu in 2019, so most visitors never see it.

Free certificates are widely available. Let's Encrypt, a non-profit certificate authority, issues DV certificates at no charge, and many hosting providers, including South African ones, install and renew them automatically. Unless you have a specific compliance requirement, a free DV certificate that renews reliably is usually all you need.

Certificates expire, and sooner than before

Every certificate has an end date. When it passes without a renewal, visitors see a full-page browser warning instead of your website, which is far more damaging than a "Not secure" label.

Lifetimes are getting shorter. Under a CA/Browser Forum decision (ballot SC-081), the maximum lifetime of a publicly trusted certificate dropped to 200 days for certificates issued from 15 March 2026, falls to 100 days in March 2027 and to 47 days in March 2029. Let's Encrypt certificates currently last 90 days, and it plans to reduce this to 45 days by 2028.

Let's Encrypt also stopped sending expiry reminder emails in June 2025. If your renewal depends on someone noticing an email, it is time to change that. Renewal needs to be automatic, and someone needs to be alerted if it fails.

A quick check for your own website

• [ ] Does every page load with https:// at the start, including the contact and checkout pages?
• [ ] If you type your address with http:// instead, are you redirected to the https:// version?
• [ ] Does the certificate cover both yourdomain.co.za and www.yourdomain.co.za?
• [ ] Do you know when your certificate expires, and does it renew automatically?
• [ ] Will someone be alerted if a renewal fails?
• [ ] Do your forms and any embedded tools (booking, payments, maps) also load securely?

If you cannot answer these with confidence, ask whoever hosts or maintains your website.

Where technology makes a difference

Certificate management is ideal for automation. A properly configured hosting account requests, installs and renews certificates on its own, redirects all traffic to HTTPS, and sends an alert to a real person if anything fails. Once that is in place, the shorter lifetimes coming over the next few years become a non-event.

How Kreativworx can help

Kreativworx provides website hosting, maintenance and technical support for South African businesses. We can check that HTTPS is working correctly on every page, set up automatic renewal and monitoring, and look at the rest of your website's security while we are there.

Sources