# What Is SSL Certificate (TLS certificate)? Definition and Examples

> SSL certificates are CA-signed X.509 documents that bind a public key to domain names or IP addresses so that TLS clients can authenticate the server.

Source: https://ssl.sh/glossary/ssl-certificate/
Last updated: 2026-11-10

An SSL certificate, more accurately called a TLS certificate, is an [X.509](https://ssl.sh/glossary/x509/) certificate whose Subject Alternative Name list states the hostnames or IP addresses it is valid for. It also contains the server's public key, the issuer's name, a serial number, a validity period and extensions, all signed by a [certificate authority](https://ssl.sh/glossary/certificate-authority/). The matching private key stays on the server and is never part of the certificate.

## Why it matters
During the TLS handshake the server sends its certificate plus intermediates; the client checks the signature chain up to a trusted root, the hostname against the SAN list, and the validity dates. Any failure produces a browser warning. Certificates are classified by how much the CA validated: [DV](https://ssl.sh/glossary/dv-certificate/) checks domain control only, while OV and EV also verify the organization. As of November 2026, publicly trusted TLS certificates issued on or after 2026-03-15 may be valid for at most 200 days, falling to 100 days from 2027-03-15 and 47 days from 2029-03-15, so automated renewal is becoming a practical necessity.

## Example
Print the subject, issuer, dates and SAN list of a live certificate:

```bash
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -ext subjectAltName
```

## Common misconceptions
- **The certificate encrypts the traffic.** Bulk data is encrypted with session keys negotiated in the handshake; the certificate authenticates the server.
- **OV or EV certificates encrypt more strongly.** Encryption strength depends on the key and cipher suite, not on the validation level.
- **A certificate belongs to one server.** It belongs to names; the same certificate and key can be installed on many servers, and one server can hold many certificates selected via SNI.

## Related terms

- [X.509](https://ssl.sh/zh/glossary/x509/): X.509 是 ITU-T 制定的公钥证书标准格式，其互联网配置规范 RFC 5280 规定了 TLS 所用证书的结构和验证方法。
- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。
- [DV 证书](https://ssl.sh/zh/glossary/dv-certificate/): DV 证书是 CA 只验证申请者对域名的控制权、不核实申请者身份的 TLS 证书，签发快且可以完全自动化。
- [OV 证书](https://ssl.sh/zh/glossary/ov-certificate/): OV 证书是 CA 在验证域名控制权之外，还核实了证书中所写组织真实合法存在的 TLS 证书。
- [EV 证书](https://ssl.sh/zh/glossary/ev-certificate/): EV 证书是按照 CA/浏览器论坛《EV 指南》完成最严格身份审核后签发的 TLS 证书。
- [SAN](https://ssl.sh/zh/glossary/san/): SAN 即主体备用名称，是 X.509 证书中列出其适用的所有域名、IP 地址等身份的扩展，客户端按它校验主机名。
- [私钥](https://ssl.sh/zh/glossary/private-key/): 私钥是非对称密钥对中保密的那一半，TLS 服务器用它证明自己拥有证书里的那把公钥。
- [证书链](https://ssl.sh/zh/glossary/certificate-chain/): 证书链是从网站终端证书经中间证书一直到受信任根证书的有序证书序列，每一张都由下一张签名。