What is a TLS certificate?

A TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. certificate is a signed document that binds a public key to a name, such as www.example.com, so that a browser or client can check it is talking to the real server and not an impostor. The signature comes from a certificate authority (CA) that the client already trusts, usually through a chain: a root CA, an intermediate CA, then the server's own certificate. During the handshake the server presents its certificate and proves it holds the matching private key. Certificates have an expiry date and can be revoked. What a certificate does not prove is that the site is safe or honest: a phishing site can have a perfectly valid certificate, because CAs mostly check control of the domain, not the business behind it. Inside companies, an internal CA often issues certificates for servers, VPNs and devices. Keep an inventory of all certificates with owners and expiry dates; forgotten ones cause outages and hide weak keys.

← All 40 questions on Encryption and encrypted trafficAll topics