# SSL/TLS Glossary: 156 Certificate and HTTPS Terms Explained > Plain-English definitions of 156 SSL/TLS, certificate, PKI and HTTPS terms, from ACME and CAA to OCSP, SNI and post-quantum TLS. Source: https://ssl.sh/glossary/ Last updated: 2026-11-10 156 SSL/TLS, certificate and HTTPS terms, each with a one-sentence definition you can quote, a short explanation, an example and the misconceptions we see most often. ## 0–9 - **[0-RTT (TLS 1.3 early data)](https://ssl.sh/glossary/0-rtt/)**: 0-RTT is a TLS 1.3 and QUIC feature that lets a returning client send application data in its very first flight, using a key from a previous session. - **[3DES (Triple DES, TDEA)](https://ssl.sh/glossary/3des/)**: 3DES (Triple DES) is a block cipher that applies DES three times with a 64-bit block size, now treated as legacy in TLS largely because of the Sweet32 attack. ## A - **[ACME (Automatic Certificate Management Environment)](https://ssl.sh/glossary/acme/)**: ACME is the IETF protocol, RFC 8555, that lets software automatically prove domain control to a CA and obtain, renew and revoke certificates. - **[ACME Profile (ACME certificate profile)](https://ssl.sh/glossary/acme-profile/)**: An ACME profile is a named certificate template a CA advertises in its ACME directory, letting the client choose lifetime and contents per order. - **[AEAD (Authenticated Encryption with Associated Data)](https://ssl.sh/glossary/aead/)**: AEAD (Authenticated Encryption with Associated Data) is a class of ciphers that encrypt data and authenticate it, plus unencrypted metadata, in one operation. - **[AES-GCM (AES in Galois/Counter Mode)](https://ssl.sh/glossary/aes-gcm/)**: AES-GCM is the AES block cipher used in Galois/Counter Mode, an AEAD construction that encrypts in counter mode and authenticates with a GHASH-based tag. - **[ALPN (Application-Layer Protocol Negotiation)](https://ssl.sh/glossary/alpn/)**: ALPN is a TLS extension that lets client and server agree on the application protocol, such as h2 or http/1.1, inside the TLS handshake. - **[ARI (ACME Renewal Information)](https://ssl.sh/glossary/ari/)**: ARI is an ACME extension, RFC 9773, in which the CA tells each client the time window in which it should renew a specific certificate. - **[Authority Information Access (AIA)](https://ssl.sh/glossary/aia/)**: Authority Information Access (AIA) is the X.509 extension giving URLs for the issuing CA's certificate and, optionally, the CA's OCSP responder. ## B - **[Baseline Requirements (BRs)](https://ssl.sh/glossary/baseline-requirements/)**: The Baseline Requirements are the CA/Browser Forum rules every publicly trusted CA must follow when validating, issuing and revoking TLS server certificates. - **[Basic Constraints (basicConstraints extension)](https://ssl.sh/glossary/basic-constraints/)**: Basic Constraints is the X.509 extension that states whether a certificate belongs to a CA and, optionally, how many CA levels may appear below it. - **[BEAST (Browser Exploit Against SSL/TLS)](https://ssl.sh/glossary/beast/)**: BEAST is a 2011 attack (CVE-2011-3389) on CBC encryption in SSL 3.0 and TLS 1.0 that exploits predictable IVs to decrypt secrets such as cookies. - **[BIMI (Brand Indicators for Message Identification)](https://ssl.sh/glossary/bimi/)**: BIMI is an email specification that lets a domain publish its logo in DNS so supporting mailbox providers can show it next to authenticated messages. ## C - **[CA Bundle (CA certificate bundle)](https://ssl.sh/glossary/ca-bundle/)**: CA bundles are files of concatenated PEM certificates: either the intermediates a server must send, or the root certificates a client trusts. - **[CA Distrust (Distrust)](https://ssl.sh/glossary/distrust/)**: CA distrust is a root program's decision to stop trusting certificates from a CA, either entirely or only for certificates issued after a cut-off date. - **[CA/Browser Forum (CA/B Forum)](https://ssl.sh/glossary/ca-browser-forum/)**: The CA/Browser Forum is a voluntary consortium of certificate authorities and browser vendors that sets baseline rules for publicly trusted certificates. - **[CAA Record (Certification Authority Authorization)](https://ssl.sh/glossary/caa/)**: A CAA record is a DNS record that lists which certificate authorities may issue certificates for a domain, checked by every public CA before issuance. - **[CCADB (Common CA Database)](https://ssl.sh/glossary/ccadb/)**: CCADB is the Common CA Database, a shared repository where CAs disclose their roots, intermediates, audits, policies and CRLs to root programs. - **[Certificate Authority (CA)](https://ssl.sh/glossary/certificate-authority/)**: Certificate Authority (CA) is an organization that validates certificate requests and signs certificates binding public keys to domain names or identities. - **[Certificate Chain (Chain of trust, certification path)](https://ssl.sh/glossary/certificate-chain/)**: Certificate chains are ordered lists of certificates, from a server's leaf through intermediates to a trusted root, each signed by the next. - **[Certificate Fingerprint (Certificate thumbprint)](https://ssl.sh/glossary/certificate-fingerprint/)**: Certificate fingerprints are hashes, usually SHA-256, of a certificate's DER encoding, used to identify one exact certificate; they are not stored in it. - **[Certificate Lifecycle Management (CLM)](https://ssl.sh/glossary/certificate-lifecycle-management/)**: Certificate Lifecycle Management (CLM) is the practice of discovering, issuing, deploying, renewing and revoking certificates in an automated way. - **[Certificate Pinning (public key pinning, SSL pinning)](https://ssl.sh/glossary/certificate-pinning/)**: Certificate pinning is a client-side check that accepts a server only if its certificate chain contains a specific, pre-configured certificate or public key. - **[Certificate Policy (CP)](https://ssl.sh/glossary/certificate-policy/)**: Certificate Policy (CP) is a named set of rules for issuing and using a class of certificates, referenced by OID in the certificatePolicies extension. - **[Certificate Renewal](https://ssl.sh/glossary/certificate-renewal/)**: Certificate renewal is obtaining a new certificate to replace one that is about to expire, ideally automatically and with a fresh key pair. - **[Certificate Revocation (Revocation)](https://ssl.sh/glossary/revocation/)**: Certificate revocation is a CA's act of declaring an unexpired certificate invalid, published through CRLs or OCSP so that clients stop trusting it. - **[Certificate Serial Number (Serial number)](https://ssl.sh/glossary/certificate-serial-number/)**: Certificate serial numbers are positive integers a CA assigns to each certificate; combined with the issuer name, they uniquely identify a certificate. - **[Certificate Transparency (CT)](https://ssl.sh/glossary/certificate-transparency/)**: Certificate Transparency is a system of public, append-only logs recording publicly trusted TLS certificates so anyone can audit what CAs issue. - **[Certification Practice Statement (CPS)](https://ssl.sh/glossary/cps/)**: Certification Practice Statement (CPS) is a CA's public description of how it validates applicants, issues and revokes certificates, and protects its keys. - **[ChaCha20-Poly1305](https://ssl.sh/glossary/chacha20-poly1305/)**: ChaCha20-Poly1305 is an AEAD cipher pairing the ChaCha20 stream cipher with the Poly1305 authenticator, designed to be fast and constant-time in pure software. - **[Cipher Suite](https://ssl.sh/glossary/cipher-suite/)**: A cipher suite is a named combination of cryptographic algorithms that a TLS client and server agree on to protect a connection, such as TLS_AES_128_GCM_SHA256. - **[Client Certificate (TLS client authentication certificate)](https://ssl.sh/glossary/client-certificate/)**: Client certificates are X.509 certificates that a TLS client presents during the handshake to prove its identity to the server. - **[Code Signing Certificate (Software signing certificate)](https://ssl.sh/glossary/code-signing-certificate/)**: Code signing certificates are X.509 certificates with the codeSigning extended key usage, used to sign software so users can verify its publisher and integrity. - **[Common Name (CN)](https://ssl.sh/glossary/common-name/)**: Common Name (CN) is the subject attribute that once held a certificate's hostname; browsers now ignore it and match names only against the SAN list. - **[CRIME (Compression Ratio Info-leak Made Easy)](https://ssl.sh/glossary/crime/)**: CRIME is a 2012 attack (CVE-2012-4929) that recovers secrets such as cookies by observing how TLS-level compression changes ciphertext length. - **[CRL (Certificate Revocation List)](https://ssl.sh/glossary/crl/)**: A CRL is a list, signed and periodically reissued by a CA, of the serial numbers of certificates it revoked before their expiry date. - **[CRLite](https://ssl.sh/glossary/crlite/)**: CRLite is Mozilla's compact revocation dataset that lets Firefox check locally, without asking the CA, whether a publicly logged certificate is revoked. - **[Cross-Signing (Cross-certificate)](https://ssl.sh/glossary/cross-signing/)**: Cross-signing is when an already-trusted CA issues a certificate for another CA's key, letting that CA's certificates chain to roots older clients trust. - **[CRT File (.crt / .cer certificate file)](https://ssl.sh/glossary/crt-file/)**: CRT files (.crt, also .cer) hold an X.509 certificate, encoded either as PEM text or as binary DER depending on the platform that produced them. - **[CSR (Certificate Signing Request)](https://ssl.sh/glossary/csr/)**: A CSR (Certificate Signing Request) is a signed message with a public key and requested identity details that an applicant sends to a CA to get a certificate. - **[CT Log (Certificate Transparency log)](https://ssl.sh/glossary/ct-log/)**: A CT log is a publicly auditable, append-only server that records certificates in a Merkle tree and issues signed timestamps promising to include them. ## D - **[DANE (DNS-Based Authentication of Named Entities)](https://ssl.sh/glossary/dane/)**: DANE is a protocol that uses DNSSEC-signed TLSA records to bind a TLS server's certificate or public key to its domain name. - **[DER (Distinguished Encoding Rules)](https://ssl.sh/glossary/der/)**: DER (Distinguished Encoding Rules) is the binary ASN.1 encoding that gives every value exactly one byte representation, used for X.509 certificates and keys. - **[DH Parameters (dhparam, Diffie-Hellman group parameters)](https://ssl.sh/glossary/dh-parameters/)**: DH parameters are the prime modulus and generator that define a finite-field Diffie-Hellman group, which a TLS server needs in order to offer DHE cipher suites. - **[Diffie-Hellman (DH key exchange; DHE when ephemeral)](https://ssl.sh/glossary/diffie-hellman/)**: Diffie-Hellman is a key-agreement method, published in 1976, that lets two parties derive a shared secret over a public channel without ever transmitting it. - **[Digital Signature](https://ssl.sh/glossary/digital-signature/)**: A digital signature is a value computed over a message with a private key that anyone holding the matching public key can verify, proving origin and integrity. - **[Distinguished Name (DN)](https://ssl.sh/glossary/distinguished-name/)**: Distinguished Name (DN) is the structured X.500-style name, built from attributes such as C, O and CN, that identifies a certificate's subject and issuer. - **[DNS-01 Challenge (DNS-01)](https://ssl.sh/glossary/dns-01/)**: DNS-01 is an ACME challenge in which the client proves domain control by publishing a CA-derived value in a TXT record at _acme-challenge. - **[DNSSEC (DNS Security Extensions)](https://ssl.sh/glossary/dnssec/)**: DNSSEC is a set of DNS extensions that lets resolvers verify, through a chain of signatures from the root zone, that DNS answers are authentic and unmodified. - **[Domain Control Validation (DCV)](https://ssl.sh/glossary/dcv/)**: Domain control validation (DCV) is the check a CA performs to confirm that a certificate applicant controls each domain name the certificate will contain. - **[Downgrade Attack (protocol downgrade, version rollback)](https://ssl.sh/glossary/downgrade-attack/)**: A downgrade attack forces a client and server to negotiate an older protocol version or weaker cipher than both support, so its weaknesses can be exploited. - **[DROWN (Decrypting RSA with Obsolete and Weakened eNcryption)](https://ssl.sh/glossary/drown/)**: DROWN is a 2016 cross-protocol attack (CVE-2016-0800) that uses any server supporting SSLv2 to decrypt TLS sessions protected by the same RSA key. - **[DV Certificate (Domain Validated certificate)](https://ssl.sh/glossary/dv-certificate/)**: DV certificates are TLS certificates for which the CA has verified only that the applicant controls the domain name, not who the applicant is. ## E - **[ECC (Elliptic Curve Cryptography)](https://ssl.sh/glossary/ecc/)**: ECC (Elliptic Curve Cryptography) is public-key cryptography based on elliptic curves over finite fields, giving strong security with small keys. - **[ECDHE (Elliptic Curve Diffie-Hellman Ephemeral)](https://ssl.sh/glossary/ecdhe/)**: ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) is a TLS key exchange in which both peers use fresh elliptic-curve key pairs for every handshake. - **[ECDSA (Elliptic Curve Digital Signature Algorithm)](https://ssl.sh/glossary/ecdsa/)**: ECDSA (Elliptic Curve Digital Signature Algorithm) is an elliptic-curve signature scheme used in TLS certificates as a smaller, faster alternative to RSA. - **[ECH (Encrypted Client Hello)](https://ssl.sh/glossary/ech/)**: ECH (Encrypted Client Hello) is a TLS 1.3 extension that encrypts the sensitive parts of the ClientHello, including SNI, with a public key published in DNS. - **[Ed25519 (EdDSA over Curve25519)](https://ssl.sh/glossary/ed25519/)**: Ed25519 is the EdDSA signature scheme on the Edwards form of Curve25519, defined in RFC 8032, with 32-byte public keys and 64-byte deterministic signatures. - **[eIDAS (EU Regulation on electronic identification and trust services)](https://ssl.sh/glossary/eidas/)**: eIDAS is the EU regulation on electronic identification and trust services, covering e-signatures, e-seals, timestamps and website authentication. - **[ESNI (Encrypted Server Name Indication)](https://ssl.sh/glossary/esni/)**: ESNI (Encrypted SNI) is an abandoned TLS 1.3 draft that encrypted only the SNI field with a key published in DNS; it has been superseded by ECH. - **[EV Certificate (Extended Validation certificate)](https://ssl.sh/glossary/ev-certificate/)**: EV certificates are TLS certificates issued after the strictest identity vetting, as defined by the CA/Browser Forum's Extended Validation Guidelines. - **[Extended Key Usage (EKU)](https://ssl.sh/glossary/extended-key-usage/)**: Extended Key Usage (EKU) is the X.509 extension listing the purposes a certificate may serve, such as serverAuth, clientAuth or codeSigning. - **[External Account Binding (EAB)](https://ssl.sh/glossary/eab/)**: External Account Binding (EAB) is an ACME feature that links a new ACME account to an existing customer account at the CA using a key ID and HMAC key. ## F - **[Forward Secrecy (Perfect Forward Secrecy (PFS))](https://ssl.sh/glossary/forward-secrecy/)**: Forward secrecy is a property of key exchange whereby compromise of a server's long-term private key does not expose the session keys of past connections. - **[FREAK (Factoring RSA Export Keys)](https://ssl.sh/glossary/freak/)**: FREAK is a 2015 attack in which a man-in-the-middle tricks vulnerable TLS clients into accepting a 512-bit export-grade RSA key that can be factored. - **[Fullchain (fullchain.pem)](https://ssl.sh/glossary/fullchain/)**: Fullchain is a PEM file containing the server's leaf certificate followed by the intermediate certificates needed to link it to a trusted root. ## H - **[Hash Function (cryptographic hash function)](https://ssl.sh/glossary/hash-function/)**: A cryptographic hash function maps input of any length to a fixed-size digest in a way that is infeasible to reverse or to make two inputs collide. - **[Heartbleed (CVE-2014-0160)](https://ssl.sh/glossary/heartbleed/)**: Heartbleed is a 2014 OpenSSL bug (CVE-2014-0160) in the TLS heartbeat extension that let anyone read chunks of server memory, including private keys. - **[HPKP (HTTP Public Key Pinning)](https://ssl.sh/glossary/hpkp/)**: HPKP is a deprecated HTTP header, defined in RFC 7469, that told browsers to accept a site only if its chain contained a pinned public key. - **[HSM (Hardware Security Module)](https://ssl.sh/glossary/hsm/)**: HSM is a tamper-resistant hardware device that generates, stores and uses cryptographic keys internally so that private keys never leave it in plaintext. - **[HSTS (HTTP Strict Transport Security)](https://ssl.sh/glossary/hsts/)**: HSTS is an HTTP response header that tells browsers to reach a site only over HTTPS for a set period and to refuse to bypass certificate errors there. - **[HSTS Preload (HSTS preload list)](https://ssl.sh/glossary/hsts-preload/)**: HSTS preload is a list of domains built into browsers that are always contacted over HTTPS, protecting even the first visit before any HSTS header is seen. - **[HTTP-01 Challenge (HTTP-01)](https://ssl.sh/glossary/http-01/)**: HTTP-01 is an ACME challenge in which the client proves domain control by serving a CA-specified token over plain HTTP on port 80. - **[HTTPS (HTTP over TLS)](https://ssl.sh/glossary/https/)**: HTTPS is HTTP carried over a TLS connection, normally on port 443, so page content, cookies and form data are encrypted and the server is authenticated. - **[Hybrid Key Exchange (hybrid post-quantum key exchange)](https://ssl.sh/glossary/hybrid-key-exchange/)**: Hybrid key exchange combines a classical algorithm such as X25519 with a post-quantum KEM such as ML-KEM, so the result is secure unless both are broken. ## I - **[Intermediate Certificate (Intermediate CA certificate)](https://ssl.sh/glossary/intermediate-certificate/)**: Intermediate certificates are CA certificates, signed by a root, that issue end-entity certificates and must be served alongside the server's certificate. - **[IP Address Certificate (IP SSL certificate)](https://ssl.sh/glossary/ip-address-certificate/)**: IP address certificates are TLS certificates whose SAN lists IP addresses, so clients can verify a server reached by IP rather than by domain name. ## J - **[JKS (Java KeyStore)](https://ssl.sh/glossary/jks/)**: JKS (Java KeyStore) is Java's original proprietary file format for storing private keys, certificate chains and trusted certificates, managed with keytool. ## K - **[Key Exchange (key establishment, key agreement)](https://ssl.sh/glossary/key-exchange/)**: Key exchange is the TLS handshake step in which client and server establish a shared secret from which the connection's symmetric keys are derived. - **[KEY File (.key file)](https://ssl.sh/glossary/key-file/)**: KEY files (.key) are files that by convention hold a private key, usually PEM-encoded, though the extension says nothing about the exact format inside. - **[Key Rotation](https://ssl.sh/glossary/key-rotation/)**: Key rotation is replacing a cryptographic key with a newly generated one, on a schedule or after an incident, to limit the damage of a compromise. - **[Key Size (Key length)](https://ssl.sh/glossary/key-size/)**: Key size is a key's length in bits; its strength depends on the algorithm, so a 256-bit ECDSA key is stronger than a 2048-bit RSA key. - **[Key Usage (keyUsage extension)](https://ssl.sh/glossary/key-usage/)**: Key Usage is the X.509 extension that limits the cryptographic operations a certificate's key may perform, such as signing data or signing certificates. ## L - **[Let's Encrypt (ISRG)](https://ssl.sh/glossary/let-s-encrypt/)**: Let's Encrypt is a free, automated, nonprofit certificate authority run by ISRG that issues domain-validated TLS certificates through the ACME protocol. - **[Logjam (CVE-2015-4000)](https://ssl.sh/glossary/logjam/)**: Logjam is a 2015 attack (CVE-2015-4000) that downgrades TLS to 512-bit export-grade Diffie-Hellman and exposes servers using small or widely shared DH groups. ## M - **[Man-in-the-Middle Attack (MITM, on-path attack)](https://ssl.sh/glossary/man-in-the-middle/)**: A man-in-the-middle attack is one where an attacker secretly relays, and may alter, traffic between two parties who each believe they talk directly. - **[Misissuance (Certificate misissuance)](https://ssl.sh/glossary/misissuance/)**: Misissuance is any certificate issuance that breaks the Baseline Requirements or a root program policy, from flawed validation to malformed fields. - **[Mixed Content (HTTP subresources on an HTTPS page)](https://ssl.sh/glossary/mixed-content/)**: Mixed content is an HTTPS page that loads some subresources, such as scripts, images or iframes, over plain HTTP, undermining the page's protection. - **[ML-DSA (Module-Lattice-Based Digital Signature Algorithm (FIPS 204))](https://ssl.sh/glossary/ml-dsa/)**: ML-DSA is the lattice-based post-quantum digital signature algorithm standardized by NIST in FIPS 204 (August 2024), derived from CRYSTALS-Dilithium. - **[ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism (FIPS 203))](https://ssl.sh/glossary/ml-kem/)**: ML-KEM is the post-quantum key-encapsulation mechanism standardized by NIST in FIPS 203 (August 2024), derived from CRYSTALS-Kyber. - **[MPIC (Multi-Perspective Issuance Corroboration)](https://ssl.sh/glossary/mpic/)**: MPIC is the requirement that a CA repeat domain validation and CAA checks from several network locations and issue only if enough of them agree. - **[mTLS (Mutual TLS)](https://ssl.sh/glossary/mtls/)**: mTLS (mutual TLS) is TLS in which both the server and the client authenticate each other with X.509 certificates during the handshake. - **[Multi-Domain Certificate (SAN certificate / UCC (Unified Communications Certificate))](https://ssl.sh/glossary/multi-domain-certificate/)**: Multi-domain certificates are TLS certificates that list several distinct hostnames in the SAN extension, so one certificate secures all of them. ## N - **[Name Constraints (nameConstraints extension)](https://ssl.sh/glossary/name-constraints/)**: Name Constraints is an X.509 extension in CA certificates that limits which names (DNS, IP, email, DN) any certificate issued beneath that CA may contain. ## O - **[OCSP (Online Certificate Status Protocol)](https://ssl.sh/glossary/ocsp/)**: OCSP is a protocol, defined in RFC 6960, that lets a client ask a CA's responder whether a single certificate is currently good, revoked or unknown. - **[OCSP Must-Staple (TLS Feature extension)](https://ssl.sh/glossary/must-staple/)**: OCSP Must-Staple is a certificate extension telling clients to reject the certificate if the server does not staple a valid OCSP response. - **[OCSP Responder (OCSP server)](https://ssl.sh/glossary/ocsp-responder/)**: An OCSP responder is the CA-operated server that answers OCSP requests with signed good, revoked or unknown statuses for the certificates the CA issued. - **[OCSP Stapling (TLS Certificate Status Request)](https://ssl.sh/glossary/ocsp-stapling/)**: OCSP stapling lets a TLS server attach a CA-signed, time-limited OCSP response to its handshake so browsers need not query the CA themselves. - **[OpenSSL](https://ssl.sh/glossary/openssl/)**: OpenSSL is an open-source cryptography toolkit made up of the libssl TLS library, the libcrypto library and the openssl command-line tool. - **[OV Certificate (Organization Validated certificate)](https://ssl.sh/glossary/ov-certificate/)**: OV certificates are TLS certificates whose CA has verified both control of the domain and the legal existence of the organization named in them. ## P - **[P-256 (secp256r1, prime256v1, NIST P-256)](https://ssl.sh/glossary/p-256/)**: P-256 is a NIST elliptic curve over a 256-bit prime field, also named secp256r1 or prime256v1, widely used for ECDSA certificates and ECDHE. - **[PEM (Privacy-Enhanced Mail encoding)](https://ssl.sh/glossary/pem/)**: PEM is a text encoding that wraps Base64-encoded DER data between BEGIN and END lines, the most common way to store certificates and keys. - **[PFX (Personal Information Exchange (.pfx))](https://ssl.sh/glossary/pfx/)**: PFX is the .pfx file that Windows and IIS use to import and export a certificate with its private key and chain, stored in PKCS #12 format. - **[PKCS #12 (Personal Information Exchange Syntax (.p12 / .pfx))](https://ssl.sh/glossary/pkcs12/)**: PKCS #12 is a password-protected binary container format that bundles a private key with its certificate and chain in one file, usually .p12 or .pfx. - **[PKCS #7 (Cryptographic Message Syntax (.p7b / .p7c))](https://ssl.sh/glossary/pkcs7/)**: PKCS #7 is a format for signed and encrypted data that, in .p7b or .p7c files, is commonly used to carry a bundle of certificates without any private key. - **[PKI (Public Key Infrastructure)](https://ssl.sh/glossary/pki/)**: PKI (Public Key Infrastructure) is the set of roles, policies, software and procedures used to issue, distribute, validate and revoke digital certificates. - **[POODLE (Padding Oracle On Downgraded Legacy Encryption)](https://ssl.sh/glossary/poodle/)**: POODLE is a 2014 attack (CVE-2014-3566) that recovers secrets such as cookies from SSL 3.0 connections in CBC mode by abusing its unchecked padding. - **[Post-Quantum Cryptography (PQC, quantum-resistant cryptography)](https://ssl.sh/glossary/post-quantum-cryptography/)**: Post-quantum cryptography (PQC) is public-key cryptography designed to resist attackers with large quantum computers, which could break RSA and ECC. - **[Precertificate (CT precertificate)](https://ssl.sh/glossary/precertificate/)**: A precertificate is a deliberately unusable copy of a certificate, marked with a poison extension, that a CA logs in CT to obtain SCTs before final issuance. - **[Private CA (Internal CA, enterprise CA)](https://ssl.sh/glossary/private-ca/)**: Private CAs are certificate authorities that an organization runs for its own systems, trusted only on devices where it installs the root. - **[Private Key](https://ssl.sh/glossary/private-key/)**: Private keys are the secret halves of asymmetric key pairs; in TLS, a server uses its private key to prove it owns the public key in its certificate. - **[PSK (Pre-Shared Key)](https://ssl.sh/glossary/psk/)**: PSK (pre-shared key) in TLS is a secret both peers already hold before the handshake, used for session resumption or to authenticate without certificates. - **[Public Key](https://ssl.sh/glossary/public-key/)**: Public keys are the shareable halves of asymmetric key pairs, published in certificates so others can verify signatures made with the matching private key. ## Q - **[QUIC (RFC 9000 transport protocol)](https://ssl.sh/glossary/quic/)**: QUIC is a UDP-based, always-encrypted transport protocol that builds the TLS 1.3 handshake into the transport and carries HTTP/3. - **[QWAC (Qualified Website Authentication Certificate)](https://ssl.sh/glossary/qwac/)**: QWAC is a certificate issued by an EU qualified trust service provider under eIDAS that links a website to the verified legal or natural person running it. ## R - **[RC4 (Rivest Cipher 4, ARC4)](https://ssl.sh/glossary/rc4/)**: RC4 is a stream cipher designed by Ron Rivest in 1987, once widely used in SSL/TLS, whose keystream biases led RFC 7465 to prohibit it in TLS in 2015. - **[Reverse Proxy](https://ssl.sh/glossary/reverse-proxy/)**: A reverse proxy is a server that accepts client connections on behalf of backend servers and forwards each request to them, often terminating TLS on the way. - **[ROBOT (Return Of Bleichenbacher's Oracle Threat)](https://ssl.sh/glossary/robot/)**: ROBOT is a 2017 finding that many TLS implementations still exposed Bleichenbacher's 1998 RSA padding oracle, letting attackers decrypt RSA key exchanges. - **[Root Certificate (Root CA certificate, trust anchor)](https://ssl.sh/glossary/root-certificate/)**: Root certificates are self-signed CA certificates that sit at the top of a certificate chain and are pre-installed in trust stores as trust anchors. - **[Root Program (Root store program)](https://ssl.sh/glossary/root-program/)**: A root program is a browser or operating-system vendor's policy and process for deciding which root CAs its trust store includes, constrains or removes. - **[RSA (Rivest-Shamir-Adleman)](https://ssl.sh/glossary/rsa/)**: RSA is a public-key algorithm, published in 1977, that TLS uses for certificate and handshake signatures and, before TLS 1.3, for key transport. ## S - **[S/MIME (Secure/Multipurpose Internet Mail Extensions)](https://ssl.sh/glossary/smime/)**: S/MIME is a standard for signing and encrypting email messages end to end using X.509 certificates and the Cryptographic Message Syntax. - **[SCT (Signed Certificate Timestamp)](https://ssl.sh/glossary/sct/)**: An SCT is a CT log's signed promise to add a certificate to its public log, which browsers require as proof that the certificate was submitted for logging. - **[Self-Signed Certificate](https://ssl.sh/glossary/self-signed-certificate/)**: Self-signed certificates are certificates signed with their own private key, so issuer and subject are identical and no CA vouches for them. - **[Session Resumption (TLS session resumption)](https://ssl.sh/glossary/session-resumption/)**: Session resumption is a TLS mechanism that lets a client reconnect using secrets from an earlier session, skipping the full key exchange and certificate check. - **[Session Ticket (TLS session ticket)](https://ssl.sh/glossary/session-ticket/)**: Session tickets are encrypted blobs of TLS session state that a server hands to the client, so the client can later resume without the server storing anything. - **[SHA-1 (Secure Hash Algorithm 1)](https://ssl.sh/glossary/sha-1/)**: SHA-1 is a 160-bit hash function from 1995 with practical collision attacks, so it is no longer accepted for signing publicly trusted TLS certificates. - **[SHA-256 (SHA-2 with 256-bit output)](https://ssl.sh/glossary/sha-256/)**: SHA-256 is the 256-bit member of the SHA-2 hash family (NIST FIPS 180-4) and the standard hash for signing and fingerprinting TLS certificates today. - **[Short-Lived Certificate](https://ssl.sh/glossary/short-lived-certificate/)**: Short-lived certificates are TLS certificates valid for only a few days, so expiry rather than revocation limits how long a compromised one can be misused. - **[SNI (Server Name Indication)](https://ssl.sh/glossary/sni/)**: SNI is a TLS extension that carries the requested hostname in the ClientHello, letting one IP address serve many HTTPS sites with different certificates. - **[SSL (Secure Sockets Layer)](https://ssl.sh/glossary/ssl/)**: SSL (Secure Sockets Layer) is the original Netscape protocol for securing network connections; TLS replaced it, but the name lives on informally. - **[SSL 3.0 (SSLv3, Secure Sockets Layer 3.0)](https://ssl.sh/glossary/ssl-3-0/)**: SSL 3.0 is the last version of Netscape's Secure Sockets Layer protocol, released in 1996, broken by POODLE in 2014 and deprecated by RFC 7568 in 2015. - **[SSL Certificate (TLS certificate)](https://ssl.sh/glossary/ssl-certificate/)**: SSL certificates are CA-signed X.509 documents that bind a public key to domain names or IP addresses so that TLS clients can authenticate the server. - **[SSL Inspection (TLS inspection, HTTPS inspection)](https://ssl.sh/glossary/ssl-inspection/)**: SSL inspection is the practice of a security gateway decrypting, inspecting and re-encrypting TLS traffic, using a private CA trusted on managed devices. - **[SSL Offloading (TLS offloading)](https://ssl.sh/glossary/ssl-offloading/)**: SSL offloading is moving the CPU work of TLS handshakes and encryption from application servers to a dedicated proxy, load balancer or hardware device. - **[SSL Stripping (HTTPS-to-HTTP downgrade)](https://ssl.sh/glossary/ssl-stripping/)**: SSL stripping is a man-in-the-middle attack that keeps a victim on plain HTTP by intercepting the redirect or links that would have moved them to HTTPS. - **[STARTTLS (opportunistic TLS upgrade)](https://ssl.sh/glossary/starttls/)**: STARTTLS is a command that upgrades an existing plaintext connection in protocols such as SMTP, IMAP and POP3 to TLS on the same port. - **[Subject Alternative Name (SAN)](https://ssl.sh/glossary/san/)**: Subject Alternative Name (SAN) is the X.509 extension listing the DNS names, IP addresses or other identities a certificate is valid for. - **[Subordinate CA (Sub-CA, issuing CA)](https://ssl.sh/glossary/subordinate-ca/)**: Subordinate CAs are certificate authorities whose CA certificate is signed by another CA, typically a root; they usually issue end-entity certificates. - **[Sweet32 (CVE-2016-2183)](https://ssl.sh/glossary/sweet32/)**: Sweet32 is a 2016 birthday attack (CVE-2016-2183) on 64-bit block ciphers such as 3DES in CBC mode that recovers secrets from very long-lived TLS connections. ## T - **[TLS (Transport Layer Security)](https://ssl.sh/glossary/tls/)**: TLS (Transport Layer Security) is the IETF standard protocol that encrypts and authenticates network connections, including every HTTPS connection. - **[TLS 1.0 (Transport Layer Security 1.0)](https://ssl.sh/glossary/tls-1-0/)**: TLS 1.0 is the first version of Transport Layer Security, published in 1999 as RFC 2246 and formally deprecated in 2021 by RFC 8996. - **[TLS 1.1 (Transport Layer Security 1.1)](https://ssl.sh/glossary/tls-1-1/)**: TLS 1.1 is the 2006 revision of Transport Layer Security (RFC 4346) that added explicit CBC IVs; RFC 8996 deprecated it together with TLS 1.0 in 2021. - **[TLS 1.2 (Transport Layer Security 1.2)](https://ssl.sh/glossary/tls-1-2/)**: TLS 1.2 is the version of Transport Layer Security defined in RFC 5246 (2008) that introduced SHA-256 based key derivation and AEAD ciphers such as AES-GCM. - **[TLS 1.3 (Transport Layer Security 1.3)](https://ssl.sh/glossary/tls-1-3/)**: TLS 1.3 is the current version of Transport Layer Security (RFC 8446 in 2018, now RFC 9846), with a one-round-trip handshake and only AEAD ciphers. - **[TLS Handshake](https://ssl.sh/glossary/tls-handshake/)**: The TLS handshake is the opening exchange of a TLS connection, in which client and server agree on version and cipher, authenticate the server and derive keys. - **[TLS Termination (SSL termination)](https://ssl.sh/glossary/tls-termination/)**: TLS termination is the point where an incoming TLS connection ends and is decrypted, such as a CDN edge, load balancer, reverse proxy or the app server. - **[TLS-ALPN-01 Challenge (TLS-ALPN-01)](https://ssl.sh/glossary/tls-alpn-01/)**: TLS-ALPN-01 is an ACME challenge where the server proves domain control on port 443 by presenting a special certificate for the acme-tls/1 protocol. - **[TLSA Record (TLSA resource record)](https://ssl.sh/glossary/tlsa/)**: TLSA records are DNS records that state which certificate or public key a TLS service on a given port must present, for use by DANE. - **[Trust Store (Root store, CA store)](https://ssl.sh/glossary/trust-store/)**: Trust stores are collections of root CA certificates that an operating system, browser or runtime treats as trust anchors when validating chains. ## V - **[Validity Period (notBefore / notAfter)](https://ssl.sh/glossary/validity-period/)**: Validity period is the time window between a certificate's notBefore and notAfter dates during which clients will accept it. - **[VMC (Verified Mark Certificate)](https://ssl.sh/glossary/vmc/)**: VMC is an X.509 certificate in which a CA verifies that an organization owns a trademarked logo, so mail clients can display it via BIMI. ## W - **[WebTrust for CAs (WebTrust audit)](https://ssl.sh/glossary/webtrust/)**: WebTrust for CAs is an audit framework in which licensed auditors check a CA's controls against CA/Browser Forum and root program requirements. - **[Wildcard Certificate (Wildcard SSL certificate)](https://ssl.sh/glossary/wildcard-certificate/)**: Wildcard certificates are TLS certificates whose name begins with an asterisk label, such as *.example.com, matching any single-level subdomain. ## X - **[X.509 (X.509 v3 certificate)](https://ssl.sh/glossary/x509/)**: X.509 is the ITU-T standard format for public key certificates; its Internet profile, RFC 5280, defines the certificates used in TLS. - **[X25519MLKEM768 (hybrid X25519 + ML-KEM-768 key exchange)](https://ssl.sh/glossary/x25519mlkem768/)**: X25519MLKEM768 is a hybrid TLS 1.3 key-exchange group that combines classical X25519 with post-quantum ML-KEM-768, used by Chrome since version 131.