HTTPS protects a connection. It does not certify honesty.

The reassuring padlock could mislead

In May 2023, the Chromium team explained its decision to replace Chrome’s padlock with a settings icon. One reason was the confusion between a secure connection and a trustworthy site. Phishing websites can use HTTPS too.

Source : Chromium — An Update on the Lock Icon (2023)

What HTTPS protects

HTTPS encrypts exchanges between your browser and the service you connect to. A domain-validated certificate establishes control of the domain through the validation process used. It does not certify product quality, order fulfilment or the company’s honesty.

Source : Let’s Encrypt — How It Works

For purchases and for your own website

Before paying or sharing sensitive information, check that the domain is the one you expected. Then look for information about the business and, when needed, contact it through a channel found independently of the message you received.

For your own business, HTTPS remains essential to a professional online presence. Enabling it does not replace clear contact details, accurate information or a proper process for handling enquiries. Trust depends on these things together.

Avoid claims such as “certified trustworthy because it uses HTTPS”. Say the connection is encrypted instead. This is less dramatic but more accurate. If a browser displays a certificate warning, do not ask customers to ignore it: have the issue investigated and corrected.