Non-wildcard SSL risky for SEO?

[scottclark]

I have a potential client who doesn't seem to be using wildcard SSLs in a multi-site scenario (over 40 sites) - what I'm wondering is the scope of Google's inspection of a site's SSL in this case:

• https://www.domain.com (good to go)
• https://domain.com (certificate error)

Will Googlebot/Google possibly consider the entire TLD insecure?

• Could the secured, www-version of the site end up with the "Site is not secure" message in the SERPs as well?
• Could this invisibly affect the client's rankings?

PS:  Yes, I know that the right thing to do is go wildcard, but I need an answer to this before recommending a large purchase to them.

[Dr-Pete]

I can't find a reference for what I'm about to say, unfortunately, but I seem to recall Google suggesting that https is a per-page consideration (and that's consistent with Google's overall philosophy) and not domain-based. So, if your indexed pages are all on "www.domain.com" (for the most part) and that version is secured, you should be ok. I've used "www" specific certs and not seen any particular signs of a problem.

Of course, if you secure "www.domain.com" and then canonicalize your entire site to "domain.com," then that's going to be a problem.

[scottclark]

As a site-wide issue, any page URL exhibits the behavior (if you remove www)

The site's preferred setting in GSC is on www.domain.com, but I don't think this is a guarantee on indexing following that suggestion completely.

It seems to me the risk vector is dependent on googlebot's behavior in Google's black box so no guarantees.

I don't think they need to treat this as an emergency, but will work repair in soon.

thanks!

S

[Dr-Pete]

Yeah, I'd say that, if Google is typically indexing the "www" version, then you're probably ok, but you can't guarantee that. 301s/canonicals should help, too.