An SSL certificate, more precisely a TLS certificate, is a digital document that binds a public key to a domain name, signed by a certificate authority that browsers trust. It lets a browser confirm it is talking to the real site and set up an encrypted connection. It does not prove the site is honest.
What does the certificate contain?
RFC 5280 defines the format used on the web. A certificate holds the subject, the subject's public key, the issuer, a validity period with start and end times, extensions such as the list of names it covers, and the issuer's signature over all of it.
Browsers match the name in the address bar against the names in the certificate. A mismatch triggers a warning. The signature lets the browser verify the certificate was issued by the stated authority and has not been altered.
How does a browser decide to trust it?
Operating systems and browsers ship with a list of trusted root authorities. A site presents its certificate plus intermediate certificates, forming a chain. The browser checks each signature up the chain to a root it trusts, that dates are valid and that the name matches. Any failure produces a warning or a blocked page.
Public authorities issue under the CA/Browser Forum Baseline Requirements, which set rules for validation and for the maximum validity period.
What happens during the connection?
The TLS handshake, defined for version 1.3 in RFC 8446, lets the client and server agree on parameters, lets the server prove its identity with the certificate, and establishes keys for encrypting the rest of the session. After that, data in both directions is protected against eavesdropping and tampering.
What types of certificate exist?
The Baseline Requirements describe validation levels. In domain validation, the authority checks only that the requester controls the domain. In organisation validation, it also verifies the organisation's identity. Either type gives the same encryption. The difference is what the certificate says about who is behind the site, which most users never inspect.
Certificates can also cover a single name, several names, or a wildcard for subdomains. Wildcards are convenient, but a stolen private key then works for every subdomain.
What does the padlock mean?
It means the connection to that domain is encrypted and the certificate checked out. It does not mean the site is safe, legitimate or free of malware. Criminals obtain certificates for their own domains too. Treat the padlock as a necessary baseline.
How long do certificates last?
The Baseline Requirements set a 200 day maximum for subscriber certificates issued from 15 March 2026, with lower maximums scheduled for 2027 and 2029. That makes renewal automation a routine need. Our post on the certificate lifecycle covers the stages in detail.
A constructed example
A visitor opens a shop's checkout page and sees a browser warning. The shop's owner finds the certificate expired the night before. The renewal email went to an old address. They renew, install the new certificate on the web server and the content delivery service, and set up automatic renewal with an alert at fourteen days. They also discover that the staging site's certificate lists only the main domain, which explains a name mismatch their testers saw.
How to check or apply this
- Open your site, view the certificate details and note the names, issuer and end date.
- Use an external checker or a command line TLS client to confirm the full chain is sent and older protocol versions are off.
- Make sure every name you serve appears in the certificate.
- Automate issuance and renewal, and monitor the live certificate from outside.
- Keep the private key on the server that needs it, with tight file permissions.
- Redirect HTTP to HTTPS and add HTTP Strict Transport Security once all pages work on HTTPS.
- Record owner and renewal contact for each certificate in a shared inventory.
Quick check
Are SSL and TLS certificates different?
No. The certificate format is the same. SSL is the old protocol name, and today's connections use TLS, so the term SSL certificate is a habit.
Does a free certificate give weaker encryption?
No. Encryption strength comes from the protocol and keys. The price of a certificate relates to validation and services, not to cipher strength.
Sources
- RFC 5280, Internet X.509 PKI Certificate and CRL Profile
- RFC 8446, TLS Version 1.3
- CA/Browser Forum Baseline Requirements
Last reviewed: 18 October 2026.
