Would a self-signed certificate impact my site for search engines? By that I mean, do robots refuse to index sites with self-signed certificates?

  • 1
    It will certainly put off visitors, anyway. You can get a free SSL certificate with no problem. All major browsers accept them.
    – paradroid
    Jan 14 '14 at 1:20
  • 1
    How often has a search engine lead you to a page with a self-signed certificate? If you were building a search engine, would you want it to have links that people couldn't safely use? Jan 14 '14 at 2:29

Using an HTTPS-only version of your site is not going to hurt your ranking, as long as during the switch (assuming you switched from a previous non-HTTPS) you apply all the necessary redirects.

However, I do not recommend using a self-signed certificate for a production website. There are essentially two reasons:

  1. The first one, is that users will notice a big red warning trying to load your site telling them that the certificate is not signed by a certificate authority and should not be trusted.

    This is not definitely a good image for your website.

  2. The second is essentially connected with the first. Because the certificate is not trusted, clients may refuse to connect to it. Clients include user browsers, but also crawlers and you may experience an impact on your visibility.

You should use a self-signed certificate only for testing. Purchase a trusted certificate for production.

Certificates today are very cheap, especially standard domain validated certificates.

  • Even if Google doesn't specifically have a ranking signal for self signed certificates, Google will notice that users get scared away by that warning message. Anything that causes users to return to Google and look for your competition is going to lower your rankings. Jan 14 '14 at 18:13

Google says they use "many things" to determine page rank. I think it is a quite reasonable leap to believe they also use certificate authenticity.

If so, because a self signed certificate is not as trusted, this would probably hurt your page ranking. I'm guessing significantly hurt it.

Furthermore, even if I was able to find your page in Google, it is likely that TrendMicro (my preferred virus software) would by default block it when I tried to view it, putting up a big red notice, "This is a dangerous page".

Also it might be worth noting that not all well known CA signed SSL certificates are the same.

One free cert for example isn't verified as much:

"90.) Why are Class 1 certificates free? ... Since Class 1 certificates are domain and/or email validated only and the process is performed mostly by electronic and automatic means, StartCom doesn't apply any fees for this type of certification." (1)

And my credit card processing company says:

"You should buy an SSL certificate from a good certificate provider. We recommend DigiCert — their certificates have very wide acceptance (and in particular should work well on mobile browsers, where many other certificate providers fall short). NameCheap is another good option. They have slightly lower acceptance but their basic certificates cost $10 to $20." (2)

It is interesting to note this StartSSL's FAQ page is NOT served by https, while Stripe's help is.

That being said, I use a self signed certificate for development and testing, which I think is the only appropriate place to use this type of certificate.

[Edit: I previously said that I thought the free certificates could not be used for credit card validation. I am now not 100% sure of this one way or another. It seems that free certificates may work some of the time, but not all of the time.]

  • This is incorrect. The free StartSSL cert is verified to the same level (in fact to a higher level) then many other certs - at least the guy behind it actually looks at it before issuing the cert rather then it being a totally automated process. Browser acceptance is similar as well. There is, of-course a difference in credibility between a cheap cert and an EV cert.
    – davidgo
    Jan 14 '14 at 18:38
  • @Davidgo: The StartSSL web site does not say one way or another if the process is automated or not for the free certificates. But let's not put common sense aside. If you were in the business of giving out something free and you could automate it would you? I believe it is probably automated. I got a free certificate there for s/mime and the process seemed automated to me. I could be wrong. Jan 15 '14 at 4:53
  • 1
    Couple of things - www.startssl.com/?app=1 (which is the StartSSL Free page) states "Because the checks are performed mostly by electronic means, they require only MINIMAL HUMAN INTERVENTION from our side." (Emphasis mine) Indeed I have had a query on a free cert issued by them, so I know they are looking at it. Its not just me, of-course - There are articles about how Eddie (Owner of StartSSL) foiled hackers because he manually looks at certs - see archive.is/Chwsn
    – davidgo
    Jan 15 '14 at 7:29
  • Point noted. Thanks for the back and forth on this. I may well try a free cert when renewal time comes in another month. Jan 15 '14 at 7:34

I don't think anyone will definitively answer the question as it falls into the "Black Art" of SEO.

A reasonably conservative and educated guess though - probably not a good idea - even for regular HTTPS with a correct secure certificate Matt Cutts (Googles SEO authority) is unsure, and the comments were not positive - and this was with everything done right - although I do note its quite an old comment.

Logically though, having a self-signed SSL cert can only make things worse, as it does not have the credibility (and presumably not the level inbound links one would otherwise get).

  • That video is 3 years ago. Nowadays using HTTPs is a very common practice. Jan 14 '14 at 17:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy