# What is a TLS certificate?

A TLS certificate is a signed document that binds a public key to a name, such as www.example.com, so that a browser or client can check it is talking to the real server and not an impostor. The signature comes from a certificate authority (CA) that the client already trusts, usually through a chain: a root CA, an intermediate CA, then the server's own certificate. During the handshake the server presents its certificate and proves it holds the matching private key. Certificates have an expiry date and can be revoked. What a certificate does not prove is that the site is safe or honest: a phishing site can have a perfectly valid certificate, because CAs mostly check control of the domain, not the business behind it. Inside companies, an internal CA often issues certificates for servers, VPNs and devices. Keep an inventory of all certificates with owners and expiry dates; forgotten ones cause outages and hide weak keys.

FAQ: [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) · https://netsenx.com/en/faq/what-is-a-tls-certificate

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/what-is-ndr

## Related questions

- [What happens when a TLS certificate expires?](https://netsenx.com/en/faq/what-happens-when-a-tls-certificate-expires)
- [Why are TLS certificate lifetimes getting shorter?](https://netsenx.com/en/faq/why-are-tls-certificate-lifetimes-getting-shorter)
- [Are self-signed certificates on internal servers a problem?](https://netsenx.com/en/faq/are-self-signed-certificates-on-internal-servers-a-problem)
- [What is mutual TLS (mTLS)?](https://netsenx.com/en/faq/what-is-mutual-tls)
- [Does a VPN encrypt everything we send?](https://netsenx.com/en/faq/does-a-vpn-encrypt-everything-we-send)