What Is a Digital Certificate? TLS Certificates and PKI Explained

What Is a Digital Certificate?

A digital certificate (also called a public key certificate or SSL-how-https-keeps-your-data-safe)/TLS certificate) is an electronic document that binds a public key to an identity — a domain-kerberos-directory-services-explained) name, organisation, or person. It is the mechanism that makes HTTPS trustworthy: your browser verifies the certificate to confirm it is really talking to the site it claims to be.

certificates-how-https-keeps-your-data-safe)-tls-how-HTTPS-keeps-your-data-safe) follow the X.509 standard, defined by ITU-T and used in TLS, email (S/MIME), code signing, and identity management.

The Problem Certificates Solve

[public key cryptography-symmetric-vs-asymmetric)](/learning-center/what-is-encryption-symmetric-vs-asymmetric) requires two parties to exchange public keys. But how do you know the public key you received actually belongs to who you think it does? Anyone could generate a key pair and claim it belongs to "bank.example.com."

certificates-how-https-keeps-your-data-safe)-tls-how-HTTPS-keeps-your-data-safe) solve this by having a trusted third party — the Certificate Authority (CA) — digitally sign the certificate. Your browser ships with a list of trusted root CAs; any certificate signed by one of them (or by an intermediate CA it certified) is automatically trusted.

Anatomy of an X.509 Certificate

Certificate:
  Version: 3
  Serial Number: 04:c2:4d:9e:... (unique per CA)
  Signature Algorithm: sha256WithRSAEncryption
  Issuer: C=US, O=Let's Encrypt, CN=R3
  Validity:
    Not Before: Jan 1 00:00:00 2026 GMT
    Not After:  Apr 1 00:00:00 2026 GMT
  Subject: CN=www.example.com
  Subject Public Key Info:
    Public Key Algorithm: rsaEncryption
    RSA Public Key: (2048 bit)
  X509v3 Extensions:
    Subject Alternative Name: DNS:example.com, DNS:www.example.com
    Key Usage: Digital Signature, Key Encipherment
    Extended Key Usage: TLS Web Server Authentication
    ...
  Signature: (CA's signature over all of the above)

Key fields:

• Subject: Who the certificate is for (domain-kerberos-directory-services-explained) or organisation)
• Issuer: Which CA signed it
• Validity: Not-before and not-after dates — certificates-how-https-keeps-your-data-safe)-tls-how-HTTPS-keeps-your-data-safe) expire
• public key: The entity's public key
• Subject Alternative Name (SAN): Additional domains this cert covers
• Signature: CA's cryptographic signature, which browsers verify

Certificate Authorities (CAs)

A Certificate Authority is an organisation trusted to issue certificates-how-https-keeps-your-data-safe)-tls-how-HTTPS-keeps-your-data-safe). The CA verifies the applicant controls the domain-kerberos-directory-services-explained) or organisation before signing.

Levels of validation:

| Type | Validation | Browser indicator | |---|---|---| | DV (domain-kerberos-directory-services-explained) Validated) | CA verifies domain ownership only | Padlock | | OV (Organisation Validated) | CA verifies organisation identity | Padlock | | EV (Extended Validation) | Rigorous identity verification | Padlock (green in older browsers) |

Major public CAs: Let's Encrypt (free, automated), DigiCert, Sectigo, GlobalSign, Amazon Certificate Manager.

The Certificate Chain of Trust

Trust flows in a hierarchy:

Root CA (self-signed, embedded in browsers/OS)
    └── Intermediate CA (signed by Root CA)
            └── End-entity certificate (signed by Intermediate CA)
                    = your website's certificate

Why intermediate CAs? Root CAs keep their private keys offline in hardware security modules. Intermediate CAs handle day-to-day signing, limiting exposure if a key is compromised.

When your browser connects to a site, the server presents its certificate plus any intermediate certificates-how-https-keeps-your-data-safe)-tls-how-HTTPS-keeps-your-data-safe). The browser verifies the chain up to a trusted root.

How Certificates Are Obtained: The CSR Process

1. You generate a key pair on your server — public key and private key-symmetric-vs-asymmetric)
2. You create a Certificate Signing Request (CSR) containing your public key and domain-kerberos-directory-services-explained) info
3. You submit the CSR to a CA
4. The CA validates your domain-kerberos-directory-services-explained) ownership (e.g., by requiring you to serve a specific file at /.well-known/acme-challenge/)
5. The CA signs the CSR and returns a certificate
6. You install the certificate and private key-symmetric-vs-asymmetric) on your server

The private key-symmetric-vs-asymmetric) never leaves your server. Only the public key is in the certificate.

Certificate Revocation

certificates-how-https-keeps-your-data-safe)-tls-how-HTTPS-keeps-your-data-safe) can be revoked before expiry if the private key-symmetric-vs-asymmetric) is compromised or the cert was issued incorrectly. Two mechanisms:

• CRL (Certificate Revocation List): A signed list of revoked serial numbers, published by the CA. Browsers download and check it periodically.
• OCSP (Online Certificate Status protocol): Browsers query the CA's OCSP responder in real time to check if a specific certificate is still valid. Faster and more current than CRLs.
• OCSP Stapling: The server periodically fetches an OCSP response and includes it in the [TLS handshake](/learning-center/what-is-SSL-tls-how-HTTPS-keeps-your-data-safe), avoiding the browser making a separate request.

Self-Signed Certificates

A self-signed certificate is signed by the same entity whose identity it claims to certify — there is no CA involved. Browsers show a prominent security warning because there is no chain of trust to verify.

Self-signed certificates-how-https-keeps-your-data-safe)-tls-how-HTTPS-keeps-your-data-safe) are used for:

• Internal services where you control all clients (e.g., internal corporate tools)
• Development and testing environments
• Learning and lab exercises

Never use self-signed certificates-how-https-keeps-your-data-safe)-tls-how-HTTPS-keeps-your-data-safe) for public-facing services.

Wildcard and Multi-Domain Certificates

• Wildcard certificate: Covers *.example.com — any one-level subdomain (e.g., mail.example.com, shop.example.com), but not a.b.example.com
• SAN certificate: Lists multiple specific domains in the Subject Alternative Name field — a single certificate can cover example.com, example.org, and api.example.net

Let's Encrypt certificates-how-https-keeps-your-data-safe)-tls-how-HTTPS-keeps-your-data-safe) automatically cover both the apex domain-kerberos-directory-services-explained) and www subdomain using SAN.

Certificates in Email: S/MIME

S/MIME certificates-how-https-keeps-your-data-safe)-tls-how-HTTPS-keeps-your-data-safe) allow email clients to digitally sign (prove origin and integrity) and encrypt (keep content confidential) email messages. The sender signs with their private key-symmetric-vs-asymmetric); the recipient verifies with the sender's public key from the certificate. Encrypted emails require the sender to know the recipient's public key.

Common Certificate Issues

| Error | Cause | Fix | |---|---|---| | Certificate expired | Validity period passed | Renew certificate | | Hostname mismatch | Certificate Subject does not match URL | Use SAN with correct domains | | Untrusted root | CA not in browser trust store | Use publicly trusted CA | | Self-signed | No chain of trust | Replace with CA-issued cert | | Revoked | private key-symmetric-vs-asymmetric) compromise or CA error | Reissue certificate |

Summary

• A digital certificate binds a public key to an identity, verified by a Certificate Authority
• X.509 is the universal certificate format used in TLS, S/MIME, and code signing
• The certificate chain of trust runs from root CA to intermediate CA to end-entity certificate
• certificates-how-https-keeps-your-data-safe)-tls-how-HTTPS-keeps-your-data-safe) must be renewed before expiry; revoked certificates are tracked via CRL and OCSP
• Self-signed certificates-how-https-keeps-your-data-safe)-tls-how-HTTPS-keeps-your-data-safe) provide no external trust and should only be used internally
• Always obtain certificates-how-https-keeps-your-data-safe)-tls-how-HTTPS-keeps-your-data-safe) from a trusted CA; Let's Encrypt provides free DV certificates for HTTPS