SSL Certificate
In short
An SSL certificate proves that a website really is reachable under the address you typed, and encrypts the connection to it. It secures the route between browser and server. It says nothing about whether the operator is trustworthy, whether the content is accurate, or whether the application behind it is secure.
The padlock means less than most people assume
It means nobody can read along on the way, and the address in the bar belongs to the certificate. That is the whole statement.
A fraudulent site can obtain a valid certificate in minutes, free of charge. The padlock is therefore not a mark of authenticity, and «look for the padlock» has been useless as fraud advice for years.
The name is historically wrong
SSL is the predecessor protocol and is considered insecure. What actually runs everywhere today is TLS. The term «SSL certificate» simply stuck; the certificate meant is the one used for TLS.
This matters at the server configuration stage: leaving old protocol versions enabled for compatibility gives you a valid certificate and a weak connection at the same time.
What it means for a Swiss website
A website without encryption is neither acceptable nor necessary today – certificates are included with practically every host and renew automatically. The most common failure is therefore not an attack but a renewal that did not run.
As soon as a form takes in personal data, encryption also forms part of data security under the Federal Act on Data Protection (FADP, SR 235.1). It does not replace any of the other duties, above all the duty to inform at the point of collection.
How we handle it
We treat the certificate as a baseline, not a feature. What comes after is more interesting: the headers instructing browsers to connect only over an encrypted channel, and the maintenance that watches the renewal.
For the server and operations behind it: managed IT and IT security.
A term in your quote that nobody explained?
In a strategy call we translate the offer in front of you – even when it did not come from us.