SSL/TLS certificate
Also known as: SSL certificate, TLS certificate, HTTPS certificate
An SSL/TLS certificate is a digital file that proves a website or server is who it claims to be and lets browsers set up an encrypted connection, shown as HTTPS.
Certificates are issued by trusted certificate authorities and expire after a set time. While certificates are essential for security, an expired one can knock a website or app offline instantly, which is why automating renewal matters more every year as maximum lifetimes shrink.
SSL/TLS certificate, explained at three levels
At home
A certificate works like a passport for a website. A trusted authority checks that the site really controls its name and stamps the passport. When you visit, your browser checks the stamp before trusting the site. Once satisfied, the browser and the site agree on a secret key that scrambles everything you send, so others on the network cannot read it.
At work
An SSL/TLS certificate is a digital file, issued by a certificate authority, that binds a domain name to a public encryption key. Browsers and apps check it before setting up an encrypted HTTPS connection. Businesses need certificates on every website, API, and many internal systems, and because they expire on a fixed schedule, managing renewals is now a routine operational task.
At home
Your browser trusts a certificate through a chain. The website's certificate is signed by an intermediate certificate authority, which is signed by a root authority whose certificate comes preinstalled in your browser or operating system. The browser checks every signature, the expiry date, and that the name matches the site. If any check fails, you see a warning page. Many sites use free certificates from Let's Encrypt, which renew automatically.
At work
Certificates use the X.509 format and are issued at three validation levels: domain validation, organization validation, and extended validation. A single certificate can cover several names through subject alternative names, or every subdomain at one level with a wildcard. Public CAs must log every certificate in Certificate Transparency logs. The ACME protocol, used by Let's Encrypt and many commercial CAs, automates proof of domain control, issuance, and renewal. Internal systems often use a private CA instead.
At home
A certificate proves only that whoever runs the site controls the domain name, plus, for some certificates, basic company details. It says nothing about whether the business is honest. Free automated certificates mean phishing sites get padlocks as easily as banks do, which is partly why Chrome replaced its padlock icon in 2023. While encryption everywhere is a big win, in my opinion the padlock was always a sign of privacy, never of trust.
At work
Certificate failures are operational, not cryptographic. Expired certificates on load balancers, firewalls, VPN gateways, and embedded devices cause outages because nobody tracked them. The CA/Browser Forum's 2025 decision cuts maximum public certificate lifetimes to 200 days from March 2026, 100 days from March 2027, and 47 days by 2029, making manual renewal unworkable. Good practice combines a full inventory, ACME automation, expiry monitoring, protected private keys, and the ability to replace every certificate quickly if a CA is distrusted.
Real-world examples
At home
Jerome tried to log into a site and got a browser warning saying the connection wasn't private. He didn't continue, and later learned the site's certificate had expired.
At work
Lena manages IT for a Winnipeg online retailer. After an expired certificate took the checkout page offline for two hours, she set up automatic renewal and expiry alerts for every certificate the company uses.
Common confusions
- SSL and TLS are different things you need to choose between. — TLS replaced SSL years ago. 'SSL certificate' is just the old name that stuck; modern certificates are used with TLS.
- A padlock means the website is safe and trustworthy. — It means the connection is encrypted and the domain was verified. Scam sites can also get certificates.
For analysts
I'd make certificate inventory and automated renewal part of IT operations now. With lifetimes heading toward 47 days, manual renewals will become a regular outage risk.
History & origin
Netscape created SSL (Secure Sockets Layer) in the mid-1990s to secure online shopping, releasing SSL 2.0 in 1995. The IETF replaced it with TLS (Transport Layer Security) in 1999, though the name 'SSL certificate' stuck. A 2011 breach of the Dutch certificate authority DigiNotar, used to issue fake Google certificates, led browsers to distrust it and pushed reforms such as Certificate Transparency logs. Let's Encrypt, a non-profit, began offering free automated certificates in 2015, helping make HTTPS the norm. TLS 1.3 arrived in 2018. In April 2025, the CA/Browser Forum voted to shrink maximum certificate lifetimes in stages, to 200 days from March 2026 and to 47 days by 2029. In my view, shorter certificate lifetimes are good security, but they'll punish any organization still renewing certificates by hand.