An SSL certificate (more precisely, a TLS certificate) is an X.509 digital certificate that cryptographically authenticates a server and enables encrypted HTTPS connections. A Certificate Authority (CA) signs the certificate after validating that you control the domain, binding your public key to your domain name.
How it works
During a TLS handshake, the server presents its certificate to the client. The client validates the certificate chain back to a trusted root CA in its system trust store, checks that the domain name matches, and verifies the certificate is not expired or revoked. Once validated, the client and server negotiate session encryption keys, and all traffic flows encrypted.
Certificate types
- Domain Validated (DV): CA verifies you control the domain (DNS check, HTTP file, or email). Fastest and cheapest.
- Organization Validated (OV): CA also verifies the organization's legal existence. Shows in certificate details.
- Extended Validation (EV): Highest assurance; requires extensive legal vetting. Historically shown with a green address bar in browsers (less common now).
- Wildcard: Single certificate covers a domain and all its subdomains (e.g.,
*.example.com). - Multi-SAN: One certificate covers multiple specific domains or subdomains.
Key points
SSL is the deprecated protocol; modern certificates use TLS. A certificate typically lasts 90 days to 1 year and must be renewed before expiry. Check your certificate status with SSL Check.
TipAlways include intermediate CA certificates in your server configuration—your certificate alone is not enough for clients to validate the full chain to a trusted root.