Does HTTPS affect SEO?

Yes, but treat it as a small, confirmed signal rather than the reason a site ranks or does not. Google announced in 2014 that HTTPS is used as a ranking signal, and has repeated since that it is a lightweight one — enough to be a tie-breaker between otherwise similar pages, not enough on its own to move a page from page three to page one.

Why it matters more in practice than the ranking weight suggests

The direct ranking effect is small, but the indirect effects are not:

• Browser warnings. Modern browsers actively label plain HTTP pages as "Not secure", particularly on any page with a form. A visitor who sees that warning and leaves is a real loss, regardless of what ranking signal caused them to find the page.
• Referrer data. Traffic moving from an HTTPS site to an HTTP one loses referrer information in some browser configurations, which can affect how well you understand where your traffic actually comes from.
• Mixed content. A page served over HTTPS that still loads some resources — images, scripts — over plain HTTP will show its own browser warnings and can fail to load those resources at all in modern browsers.

Put together, an insecure site is disadvantaged by more than the ranking algorithm alone accounts for.

Moving from HTTP to HTTPS correctly

Enabling the certificate is only half the job. Every HTTP version of every URL needs a 301 redirect to its HTTPS equivalent, and every internal link, image reference and script tag on the site should point at the HTTPS address directly rather than relying on a redirect to catch it each time. A site running both versions side by side without redirects effectively duplicates every page, which creates its own separate problem — see fixing duplicate content.

Once redirects are in place, update your Search Console property and your sitemap to reference the HTTPS URLs, since the old HTTP versions are no longer the ones you want crawled and indexed going forward.