SSL Certificate (TLS certificate)

An SSL certificate, more accurately called a TLS certificate, is an X.509 certificate whose Subject Alternative Name list states the hostnames or IP addresses it is valid for. It also contains the server's public key, the issuer's name, a serial number, a validity period and extensions, all signed by a certificate authority. The matching private key stays on the server and is never part of the certificate.

Why it matters

During the TLS handshake the server sends its certificate plus intermediates; the client checks the signature chain up to a trusted root, the hostname against the SAN list, and the validity dates. Any failure produces a browser warning. Certificates are classified by how much the CA validated: DV checks domain control only, while OV and EV also verify the organization. As of November 2026, publicly trusted TLS certificates issued on or after 2026-03-15 may be valid for at most 200 days, falling to 100 days from 2027-03-15 and 47 days from 2029-03-15, so automated renewal is becoming a practical necessity.

Example

Print the subject, issuer, dates and SAN list of a live certificate:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

Common misconceptions

• The certificate encrypts the traffic. Bulk data is encrypted with session keys negotiated in the handshake; the certificate authenticates the server.
• OV or EV certificates encrypt more strongly. Encryption strength depends on the key and cipher suite, not on the validation level.
• A certificate belongs to one server. It belongs to names; the same certificate and key can be installed on many servers, and one server can hold many certificates selected via SNI.