What Does an SSL Certificate Do? Explained Simply
Abhay Khant
Jan 1, 1970 • 7 min read
What Does an SSL Certificate Do? Explained Simply
- An SSL certificate enables TLS encryption between browser and server
- It also proves identity: the domain is controlled by whoever holds the key
- Modern certificates come free via Let's Encrypt and renew every 90 days
- HTTPS is table stakes: browsers flag plain HTTP as Not Secure
The short answer to what an SSL certificate does
An SSL certificate does two jobs at once. First, it enables encryption: when a visitor's browser connects to a site, the certificate kicks off [TLS](https://developer.mozilla.org/en-US/docs/Web/Security/Transport_layer_security), the protocol that scrambles everything traveling between browser and server so nobody in between can read or tamper with it. Second, it proves identity: the certificate binds a domain name to a cryptographic key pair, demonstrating that the server answering really belongs to whoever controls that domain.
The name is a historical artifact. SSL, the old protocol, was replaced by TLS decades ago, but the certificate file kept the SSL label and the name stuck. When someone says SSL certificate today, they mean a TLS certificate; the terms are interchangeable in practice.
How it works during a page load
When your browser visits an HTTPS site, a quick exchange called the handshake happens before any page data flows. As [MDN's TLS overview](https://developer.mozilla.org/en-US/docs/Web/Security/Transport_layer_security) describes, the server presents its certificate, the browser checks it against its list of trusted certificate authorities, and both sides establish session keys through asymmetric cryptography before switching to fast symmetric encryption for the actual traffic.
Three checks happen in that handshake, and failure at any one triggers the familiar browser warning: the certificate must be valid (not expired), it must match the domain you typed, and it must chain back to an authority your browser trusts. The padlock icon in the address bar means all three passed.
What a certificate contains
| Field | What it says |
|---|---|
| Subject (CN/SAN) | The domain(s) the certificate covers |
| Issuer | The certificate authority that vouched for it |
| Validity dates | The window where the certificate counts |
| Public key | Half of the key pair used in the handshake |
| Signature | The CA's cryptographic stamp of approval |
You can inspect all of this yourself on any site: the SSL checker shows the issuer, validity window, and covered domains without opening developer tools, which makes it the fastest way to answer why-is-this-site-warning questions.
Validation levels: DV, OV, EV
Certificate authorities offer three verification tiers. Domain Validation (DV) confirms you control the domain, nothing more; it is automated, free via [Let's Encrypt](https://letsencrypt.org/), and accounts for most certificates on the web today. Organization Validation (OV) adds a light check that an organization exists behind the request. Extended Validation (EV) historically required deeper legal vetting and displayed company names in the address bar, though modern browsers dropped the special EV display once studies showed users barely noticed it, a shift recorded in the [EV certificate history](https://en.wikipedia.org/wiki/Extended_Validation_Certificate). For nearly every use case, DV provides identical encryption; the tiers differ only in how much identity vetting happened, not in connection strength.
A real certificate, inspected
Here is an actual certificate pulled from a production server while researching this article. Running an openssl handshake against wikipedia.org returned these facts: the subject is *.wikipedia.org, the issuer chain reaches Let's Encrypt through one intermediate certificate named YE2, validity runs from August 5, 2026 to November 3, 2026, and the Subject Alternative Name extension lists more than thirty hostnames covering every Wikimedia project domain plus the short-link service w.wiki.
Three details from that one certificate show how issuance works at scale. The SAN list does the real work: a single certificate legitimately covers wikipedia.org, wiktionary.org, wikidata.org, and dozens more names, which the subject field alone could never express. The Let's Encrypt issuer shows a free automated authority serving some of the busiest infrastructure on the internet. And the roughly ninety-day validity window reflects deliberate modern practice, because short-lived credentials shrink the damage window of a stolen key.
Why HTTPS became non-negotiable
- Browser pressure: Chrome and Firefox now label plain HTTP pages as Not Secure, per [Google's transparency reporting](https://transparencyreport.google.com/https/overview) showing HTTPS adoption above 90% of page loads
- SEO signals: search engines have treated HTTPS as a ranking signal since 2014, starting with [Google's original announcement](https://security.googleblog.com/2014/08/https-as-ranking-signal_6.html)
- Feature gates: many modern browser APIs (service workers, geolocation) require secure contexts
- User trust: visitors increasingly recognize the padlock as baseline competence
The cost side collapsed: with free automated certificates from Let's Encrypt and 90-day auto-renewal, running HTTPS is now easier than explaining why a site lacks it.
Why certificates last only 90 days now
Older certificates carried one- or two-year lifetimes; practice has since converged on short windows, with [Let's Encrypt issuing 90-day certificates](https://letsencrypt.org/docs/faq/) by design. Short-lived credentials limit the harm a stolen key can do, push teams toward automation instead of calendar-driven manual renewals, and let mistakes age out quickly. The catch is that renewal must be automatic, which is precisely what the ACME protocol delivers: a client proves domain control by answering a challenge, downloads a fresh certificate, and reloads the server without human hands.
Automation still has edges worth knowing. Issuance runs under rate limits tied to your registered domain, so pipelines that bulk-reissue across many subdomains can hit caps unexpectedly; skimming the published [rate limit documentation](https://letsencrypt.org/docs/rate-limits/) prevents surprises when wiring continuous deployment.
TLS versions and what sits underneath
The certificate is an identity document; encryption comes from the TLS protocol negotiated during the handshake. TLS 1.3, specified in [RFC 8446](https://datatracker.ietf.org/doc/html/rfc8446), trimmed the handshake to a single round trip and removed legacy cipher suites, making connections faster and safer than older negotiations. SSLv3 along with TLS 1.0 and 1.1 are formally deprecated, and hardened servers reject them outright. The certificate document format itself follows [X.509 as defined in RFC 5280](https://datatracker.ietf.org/doc/html/rfc5280), which specifies the field layout summarized in the table above.
HSTS: staying encrypted after the first visit
A valid certificate still leaves one gap: a brand-new visitor who types the bare domain might land on plain HTTP before any certificate enters the picture. HTTP Strict Transport Security closes it. The server sends the [Strict-Transport-Security header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security), telling browsers to refuse insecure connections to that domain for a chosen period; after the first visit, even manually entered http:// addresses get upgraded automatically. Certificate plus HSTS covers both halves: encryption for this visit, enforcement for every future one.
Common certificate problems and fixes
| Problem | Symptom | Fix |
|---|---|---|
| Expired certificate | Full-page browser warning | Renew; automate with ACME clients |
| Name mismatch | Warning despite valid cert | Cover www and apex, or use SANs |
| Incomplete chain | Works on some devices, fails others | Serve intermediate certificates |
| Mixed content | Padlock with warning triangle | Load every asset over HTTPS |
Mixed content deserves special attention after migrations: one leftover http:// image reference downgrades an otherwise perfect HTTPS page, the exact condition [MDN's mixed content guide](https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content) documents. The technology detection workflow includes certificate inspection among its infrastructure checks for exactly this reason.
Certificates in practice
An SSL certificate is simultaneously a lock and an ID card: it encrypts the connection and vouches for who holds it. Getting one is free, renewal is automatic, and every modern platform expects it. Check any domain's certificate details with the SSL checker, automate issuance with Let's Encrypt on your own properties, and treat the padlock as hygiene rather than achievement; the real security work continues past it.
