What the padlock is certifying
Two things, and nothing beyond them. Nobody positioned between the browser and the server can read the traffic or alter it, and the server has demonstrated to a certificate authority that it controls the domain you typed. Control of the name is the entire content of domain validation, which is why a fraudulent shop can display precisely the same padlock as a bank: the lock speaks to the privacy of the line, never to the integrity of whoever answers on the other side. The naming is its own muddle. SSL was retired as a protocol long ago and TLS took the job, but those three older letters are burned into control panels, invoices and everyday speech, so you will go on buying and troubleshooting something everyone calls SSL while the handshake on the wire is TLS.
Where the encryption stops
TLS covers the journey and neither end of it. Traffic is decrypted the moment it reaches your CDN edge or your web server; from there inward to the application, and everywhere the data rests afterwards in databases, logs and backups, you are looking at separate decisions with separate failure modes. Announcing that a site has SSL describes one leg of the trip.
Obtaining a certificate stopped being a purchase and became a background job. Let's Encrypt issues domain-validated certificates at no charge over ACME, an automated exchange in which your server proves it controls the name, collects a short-lived certificate and repeats the exercise before that one lapses. Hosts, CDNs and platforms now run the loop for you, and the short lifetime is the point rather than an inconvenience: renewal that must happen often has to be automated, and automation that runs constantly breaks loudly and early instead of silently once a year. Authorities must also publish every issuance to public Certificate Transparency logs, so you can check what has been signed for your own names, and a wildcard certificate covering all subdomains at once is obtained through the same machinery, proving control by a DNS record rather than by a file placed on the site. The surrounding web moved in step. Browsers will negotiate HTTP/2 only over an encrypted connection, service workers and the geolocation API refuse to run on a plain connection, and an unencrypted page collects a 'not secure' label beside the address. Encryption is no longer an upgrade anybody sells you; it is the condition for participating.