Glossary · ENCheck a domain

TLS certificate

A TLS certificate is a digitally signed document that connects a public key to one or more identities, such as a website's domain name. During a secure connection, a server presents its certificate so the client can check that the key and identity are acceptable for the service it meant to reach. The certificate helps verify the server's identity; TLS uses digital keys to protect the connection itself.

What does a website certificate contain?

A certificate in the X.509 format can contain the public key, the names it is valid for, a validity period, the issuer's identity, and a digital signature. A certification authority (CA) is an organization whose certificate-signing key is trusted by software under its trust rules. The browser checks the server certificate and may verify a chain of certificates up to a trusted CA. It also checks that the name in the certificate matches the domain in the URL and that the certificate is valid for the current time and purpose.

For example, if a browser visits https://shop.example.com, it checks that the presented certificate covers shop.example.com and that the browser accepts the chain of signatures linking it to a trusted issuer. If the name does not match, the browser should show a certificate error. A certificate for example.com does not automatically cover every subdomain unless the certificate's names include them under the applicable matching rules.

What does a certificate prove?

A valid certificate helps show that the server controls a key associated with the requested domain name under the certificate system's checks. It does not prove that the site belongs to a trustworthy company, that a shop will deliver an order, or that a page contains no malware or fraud. A phishing site can obtain a certificate for its own domain and still use HTTPS.

A certificate is also not the website's content, a DNS record, or the encryption algorithm. DNS may help find the server; the certificate helps check its identity; TLS establishes the protected channel; and HTTP carries the web request and response. These parts work together but answer different questions.

Related terms