Understanding SSL/TLS certificates
What an SSL certificate really is, what it contains, who issues it, and why it always ends up expiring.
Reading time: 4 min Updated on 26 October 2026
The little padlock in the address bar relies on a file of just a few kilobytes: the SSL certificate, which should really be called a TLS certificate. The SSL protocol was abandoned long ago, but the name stuck. This guide explains what that file contains, who issues it, and why its expiration date is the weak spot of most websites.
What a certificate is for
A certificate does two jobs at once:
- Encrypt the connection between the browser and the server. Passwords, forms and cookies no longer travel in plain text.
- Prove the identity of the server. The browser checks that it is really talking to
example.com, and not to a middleman pretending to be it.
Without a valid certificate, browsers show a full-screen warning and most visitors leave. APIs and mobile apps simply refuse to connect.
What a certificate contains
A certificate is a signed document that binds a public key to one or more domain names. It includes, among other things:
- The names covered (the Subject Alternative Name field):
example.com,www.example.com, or*.example.comfor a wildcard certificate. - The issuer: the certificate authority (CA) that signed the certificate, such as Let's Encrypt, Sectigo or DigiCert.
- The validity period: a start date (notBefore) and an end date (notAfter). After that date, no browser will accept it.
- The public key and its algorithm (RSA 2048-bit, ECDSA P-256…).
The matching private key is not in the certificate: it stays on your server and must never leave it.
The chain of trust
Your browser doesn't know your certificate. It trusts a handful of root authorities preinstalled in the operating system. These roots sign intermediate certificates, which in turn sign your certificate.
So the server must send your certificate and the intermediates (often called the fullchain). If it sends only the certificate, some browsers cope, but many clients (curl, mobile apps, APIs) show an error like "unable to get local issuer certificate".
Validation levels: DV, OV, EV
| Type | What is verified | Turnaround | Typical use |
|---|---|---|---|
| DV (Domain Validation) | That you control the domain | A few seconds to a few minutes | The vast majority of websites, Let's Encrypt |
| OV (Organization Validation) | The domain and the company's legal existence | One to a few days | Corporate websites, contractual requirements |
| EV (Extended Validation) | In-depth checks on the organization | Several days | Banks, large enterprises |
Encryption is exactly the same in all three cases. Since browsers stopped showing a green bar for EV, the difference is mostly administrative.
Why a certificate expires
A certificate can't be "unlimited". The maximum lifetime is set by the CA/Browser Forum, which brings together certificate authorities and browser vendors. It has been cut by more than six times in fifteen years, and it keeps going down: 200 days since March 2026, then 100 days in 2027 and 47 days in 2029. Let's Encrypt certificates currently last 90 days. We cover this timeline in detail in our guide to the move to 47 days.
Short lifetimes limit the damage if a key is compromised and force automation. But they also multiply the chances of something being forgotten: an automatic renewal that fails silently, an expired credit card at the provider, a server migrated without its scheduled task…
Key takeaways
- A certificate binds a public key to domain names, for a limited time.
- The server must send the full chain, not just the certificate.
- DV, OV and EV encrypt the same way; only the identity verification differs.
- Validity periods are getting shorter: monitoring expiration dates is becoming essential, even with automatic renewal.
Want to see all of this on your own site? Run the free SSL checker: it shows the issuer, the names covered, the expiration date and the protocol in use.