HTTPS encryption

HTTPS is HTTP carried over a TLS connection, so the client can check it is talking to the server named in the address and nothing on the path between them can read or alter what passes. It protects the transport of a page, and says nothing about whether the page is true.

What the connection proves

RFC 9110, section 4.2.2 defines an https origin by two conditions. The server has to prove it holds the private key matching a certificate the client trusts for that host, which is where its authority to speak for the name comes from. And the exchange has to have confidentiality and integrity protection acceptable to both sides. Authentication, secrecy and tamper-evidence are the whole of it. A certificate does not vouch for the business behind the domain, only for the domain.

Where search stands

Google said in 2014 that HTTPS is one of its ranking signals and a lightweight one next to content quality, with a stated intent to strengthen it over time. The more concrete effect is in canonical selection: when the same page answers on both schemes, Google prefers the HTTPS URL as the version to index. So a site that serves both without redirecting has two copies of itself and has left the choice to the engine.

Crawlers and the scheme

An AI crawler fetching a page is an HTTP client like any other, and a redirect from the http address to the https one costs it a hop. This site’s free crawler-access check requests only over HTTPS, from a DNS-validated public host, and reads two text files: the robots file and the llms.txt. It reports what came back and does not assess the certificate beyond the connection succeeding.

A common question

Does a valid certificate say anything about the business behind the domain?

No. The certificate proves the server holds the private key matching a certificate the client trusts for that host name, and that the exchange carries confidentiality and integrity protection both sides accept. That covers authentication, secrecy and evidence of tampering, and it stops there: the guarantee attaches to the domain, not to whoever operates it. HTTPS protects how a page travels, and it says nothing at all about whether what the page claims is true.

Sources

Definition of the https scheme: RFC 9110, section 4.2.2. Ranking signal: Google Search Central blog, HTTPS as a ranking signal. Canonical preference: how to specify a canonical.