In more detail
The browser checks the server's Digital certificate and then encrypts everything with TLS, so people on the same Wi-Fi cannot read or change what you send. During the handshake the two sides agree on keys, the browser verifies the certificate chain up to a trusted authority and checks that the name on it matches the host. HTTPS uses port 443 by default. The padlock means the connection is secure, not that the site is trustworthy. HTTPS is also required for many browser features and is a minor search ranking signal.
Why it matters
An HTTPS page that loads scripts or images over plain HTTP ("mixed content") has those requests blocked or flagged by the browser. Certificates expire, and an expired one shows visitors a full-page warning, so renewal should be automated (for example with ACME clients such as those used for Let's Encrypt). See How HTTPS and TLS Work.
Example
After moving a site to HTTPS, this response header tells browsers never to use plain HTTP for it again:
Strict-Transport-Security: max-age=31536000; includeSubDomains
31,536,000 seconds is 365 days; for that period the browser rewrites any http:// link to the site as https:// before sending it.