TLS Certificate
A TLS certificate is a digital certificate used to help establish an authenticated, encrypted connection between a website and a client such as a web browser.
It binds cryptographic identity information to a domain or other internet service.
MDN describes digital certificates as records binding cryptographic keys to an organization or website identity and certificate authorities as the trusted entities that sign those certificates. MDN's certificate-authority glossary
TLS vs. SSL
The modern protocol is TLS, or Transport Layer Security.
SSL, or Secure Sockets Layer, is its obsolete predecessor.
The phrase:
SSL certificate
remains widely used commercially, but modern websites actually use TLS.
MDN notes that SSL has been superseded by TLS. MDN's SSL glossary
What the Certificate Does
When a browser connects securely, the certificate helps establish that:
The server presenting this certificate is authorized for this domain.
The TLS protocol then establishes encrypted communication.
The certificate does not itself contain or encrypt the entire website.
It participates in the process that establishes the secure connection.
Certificate Authorities
Certificates are commonly issued by trusted Certificate Authorities.
Let's Encrypt is a nonprofit certificate authority that provides automated TLS certificates.
Its current issuance process uses the ACME protocol to verify control over a domain before certificates are issued or renewed. How Let's Encrypt works
Certificate Coverage
A certificate may cover:
- One hostname
- Several hostnames
- A wildcard such as
*.example.com
A certificate for:
example.comdoes not automatically mean every possible Subdomain is covered.
The exact certificate names matter.
Automatic Renewal
Modern hosting services frequently automate certificate issuance and renewal.
Let's Encrypt's model is explicitly designed around automated validation, issuance, renewal, and revocation.
This significantly reduces the need for manual certificate purchasing and installation on many modern hosting platforms.
Why It Matters
A missing, invalid, expired, or mismatched certificate can cause browsers to show a security warning or refuse a trusted HTTPS connection.
Common Problems
Common problems include:
- Certificate expired
- New subdomain not covered
- DNS points to a server with a different certificate
- HTTP site never redirected to HTTPS
- Certificate renewed on one server while traffic reaches another
- Old terminology causing SSL and TLS to be treated as separate modern technologies
How to Improve
Prefer automated certificate management.
When moving hosting or adding hostnames:
- Verify each hostname
- Confirm HTTPS
- Check automated renewal
- Test both root and
www - Test important subdomains