What SSL Actually Means for Your Dealership (And What Happens When It Expires)

SSL is what encrypts information between your customer’s browser and your website. It’s the reason you see the little padlock next to a web address. It’s the reason the URL starts with “https://” instead of just “http://”.

Without SSL, browsers warn visitors that your site isn’t secure. That’s not a great first impression when someone is about to submit a credit application.

What SSL is, in plain English

SSL (Secure Sockets Layer) is the old name for what we now call TLS (Transport Layer Security). The industry still says “SSL” out of habit. The job is the same: encrypt the connection between the browser and the server so nobody in the middle can read the data.

When a customer fills out a credit application on your site, they’re typing their name, address, social security number, employment info, and income. Without encryption, that data travels as plain text. Anyone on the network path — the coffee shop WiFi, the hotel network, a compromised router, an ISP — can read it.

With SSL/TLS, the data is encrypted in transit. Even if someone intercepts it, all they see is scrambled noise.

The padlock in the browser tells the customer two things: the connection is encrypted, and the site is who it claims to be (verified by a trusted certificate authority).

Why SSL matters for dealerships

Three reasons, in order of how much they hurt:

• Customer trust. A “Not Secure” warning on a credit application page is a conversion killer. Studies consistently show that a majority of shoppers abandon a form when they see the warning. Some of them call the next dealer on the list. Some of them don’t apply at all.
• Google rankings. HTTPS has been a confirmed Google ranking signal since 2014. Chrome has been marking HTTP sites “Not Secure” since 2018 and gradually tightening the warnings.
• Compliance. If you process payments or accept credit applications online, your processor and the relevant regulations (PCI DSS, GLBA Safeguards Rule, state data breach laws) expect encryption in transit. A site without TLS is a compliance gap that an auditor will flag.

What breaks when SSL breaks

The most common SSL incidents:

• The certificate expired. The website shows a scary red warning. Some browsers block the page entirely. The dealer finds out when customers start calling.
• The certificate is misconfigured. A subdomain was added that doesn’t have a certificate. Or the certificate was renewed but the old one wasn’t properly replaced.
• Mixed content. The page loads over HTTPS, but images, scripts, or iframes are still on HTTP. Browsers block or warn. The padlock goes away.
• The certificate is on the wrong hostname. The certificate is for yourdealership.com but the customer is visiting www.yourdealership.com (or vice versa). Browsers warn.
• The chain of trust is incomplete. The certificate is valid, but the intermediate certificate isn’t installed correctly. Some browsers trust it; some don’t. The user experience is inconsistent and confusing.

All of these are preventable. Most of them are caused by whoever manages the certificate forgetting about it.

What you should know without becoming a cryptographer

You don’t need to understand the math. You do need to know four things:

1. Do we have an SSL certificate, and what hostname(s) is it valid for? (Get the answer in writing. “We have SSL” is not the same as “we have SSL for every page customers can reach.”)
2. When does it expire? (Most certificates are valid for 90 days, 1 year, or longer. The cert on yourdealership.com is rarely the only cert. There are usually several — for subdomains, the API, the customer portal.)
3. Who manages the renewal? (Your website vendor, your IT company, your hosting provider. Find out which.)
4. Is auto-renewal in place, and has it been verified to actually work? (A certificate that auto-renews but isn’t installed correctly still fails.)

The fix isn’t buying a certificate. It’s making sure it never lapses.

Modern hosting platforms and certificate authorities (Let’s Encrypt in particular) have made SSL automatic and free. The bottleneck isn’t cost. The bottleneck is process:

• Inventory all certs. Apex, www, every subdomain with its own content, every service with its own hostname.
• Set up monitoring. External services (SSL Labs, UptimeRobot, statuscake) that alert well before expiration. 30 days minimum, ideally 60.
• Verify auto-renew. The renewal succeeded in staging? Verify it succeeds in production. A misconfigured ACME challenge or a missing DNS record will silently break auto-renew.
• Test the chain. Use SSL Labs’ SSL Server Test or openssl s_client -connect to verify the full chain is correct.
• Plan for subdomain coverage. Adding a new subdomain without a cert is the most common cause of “mixed content” warnings.

The bottom line

SSL is the lowest bar in modern web security. It’s free, it’s automated, and every major hosting platform supports it. If your dealership’s certificate ever expires in production, that’s not a technology problem. That’s a process problem.

You don’t need to be dangerous with cryptography. You need to be dangerous about asking your vendor how certificate expiration is monitored.

Next in the series: “What is a CDN, and why does it make your dealership website faster?”

Part of the Just Enough to Be Dangerous infrastructure series from VCTRS. For the technical version to hand your IT team or vendor, read SSL/TLS for Car Dealerships: A Technical Reference.