SSL certificates: myths and facts

A lot of confusion and excitement hit the Brazilian market with the arrival of the LGPD, Brazil’s data protection law. And with the excitement came a host of people, companies and promises about the much-needed SSL certificate.

Security certificate, green padlock, secure site, SSL, TLS, HTTPS… So many names for one thing. This post will help you better understand what a security certificate really is, and debunk what we hear out there, separating the facts from the myths.

You can issue an SSL certificate by installing a WordPress plugin

MYTH. Only Certificate Authorities can issue SSL certificates. The process involves different levels of validation before the certificate is issued. WordPress plugins are just tools that adapt a page after the certificate has been issued and set up.

Certificates issued by authorities have better encryption

MYTH. All SSL certificates offer the same level of data encryption. Many companies use marketing strategies and the credibility of their brands to imply that their certificates offer more protection. That way, they can charge more for the service.

Paid certificates offer more protection

MYTH. Something few people know is that issuing SSL certificates is free. Initiatives such as Let’s Encrypt help developers issue SSL certificates for free.

What really makes the difference is how your certificate is set up. That’s more complex, manual work, and many large companies choose not to do it, since merely issuing the certificate is a 100% automatable task and an excellent business model.

Just buying a certificate makes my site secure

MYTH. Getting an SSL certificate is useless if it isn’t set up correctly. In many cases, parts of the site’s code must be changed so that the connection is 100% encrypted and the certificate works properly.

If the setup isn’t done right, the site may show a “mixed content” warning in visitors’ browsers. See how to spot this warning in How to check whether your business uses secure connections.

Encrypted sites are faster

FACT. It seems counterintuitive, but increasing a site’s protection doesn’t reduce its speed; it increases it. An HTTPS connection uses the HTTP/2 protocol, which is faster.

SSL certificates help you rank better on Google

FACT. Since July 2017, Google has penalized insecure sites, keeping them out of the top positions. In addition, Google Chrome and other browsers keep getting updates that make it ever more obvious to visitors that they’re browsing an insecure environment, through banners, warnings and notifications.