SSL Certificate

An SSL certificate (technically a TLS certificate) is a digital file that binds a cryptographic key pair to an organization or domain identity. It enables encrypted HTTPS connections and is verified by a Certificate Authority (CA).

Category: Security (also: Infrastructure, Web Development)

Author: Atomic Glue Security Team

## Definition

An SSL certificate is a digital certificate that authenticates the identity of a website and enables an encrypted connection using TLS. The certificate contains the domain name, the issuing Certificate Authority (CA), the certificate's valid date range, and the public key needed to establish the encrypted connection. When a browser connects to a website, the server presents its certificate, and the browser checks it against a list of trusted CAs. If the certificate is valid, the encrypted session proceeds. If not, the browser shows a security warning.

## Validation Levels

There are three levels of certificate validation. **Domain Validation (DV)** confirms only that the applicant controls the domain. Cheap or free, issued automatically. **Organization Validation (OV)** also verifies the organization's legal identity. **Extended Validation (EV)** requires a thorough vetting process. Previously EV was indicated by a green bar in browsers, but that visual treatment has been removed by most browsers. EV still confers a higher trust level but is not visibly distinct from OV/DV in modern browsers.

## Certificate Lifecycle

Certificates have a validity period (currently capped at 90 days for public TLS certificates under CA/Browser Forum guidelines, down from the previous multi-year maximum). They must be renewed before expiry. Automated protocols like ACME (used by Let's Encrypt) handle renewal transparently. Expired certificates cause browser security warnings that drive users away.

## The SSL Cert Means Site Is Secure Myth

An SSL certificate means the connection is encrypted. It does not mean the website is trustworthy, legitimate, or free from malware. Phishing sites routinely obtain DV certificates from Let's Encrypt and other CAs. The padlock icon indicates encryption, not endorsement. Do not teach users to equate the padlock with safety from scams.

## Note

The term SSL certificate is a misnomer. SSL (Secure Sockets Layer) was deprecated in 2015. What you buy or generate today is a TLS certificate. The industry continues to use SSL certificate out of habit.

## Common questions

Q: Do I need to pay for an SSL certificate?

A: No. Let's Encrypt provides free DV certificates that are functionally identical to paid DV certificates. The difference is validation level (DV vs OV/EV) and support. For most websites, Let's Encrypt is sufficient.

Q: What happens if my certificate expires?

A: Browsers will show a 'Your connection is not private' warning. Visitors may leave, and some browsers block access entirely. Automated renewal (ACME) prevents this.

Q: Can a self-signed certificate be used in production?

A: No. Self-signed certificates are not trusted by browsers because no CA verified them. Use them only for local development and internal testing.

## Key takeaways

• SSL cert = TLS cert. The connection is encrypted, not the site's trustworthiness.
• DV certificates are free via Let's Encrypt. OV and EV add identity verification.
• Certificate expiry causes browser warnings. Automate renewal.
• A padlock does not mean a site is safe from phishing or malware.

## Related entries

• [HTTPS / TLS](atomicglue.co/glossary/https-tls)
• [HSTS](atomicglue.co/glossary/hsts)
• [Security Headers](atomicglue.co/glossary/security-headers)

Last updated December 2024. Permalink: atomicglue.co/glossary/ssl-certificate