What a digital certificate does
A digital certificate is a file that proves who you are on the internet, the same way a driver's license proves who you are in person. When you visit a website, your browser checks that website's certificate to confirm it is actually the company it claims to be, not a fake site stealing your information. The certificate contains the website's name, the organization that verified it, and a unique code that proves the certificate has not been tampered with.
Think of it this way: a certificate is a digital ID card issued by a trusted third party. That third party — called a certificate authority — has already checked that the website owner is real and owns the domain name they claim to own. When your browser sees a valid certificate, it knows the connection is safe. When a certificate is missing or fake, your browser warns you before you enter any information.
Certificates work alongside encryption. Encryption scrambles your data so only the right person can read it. A certificate proves that the person reading it is actually who they say they are. Together, they keep your passwords, credit card numbers, and personal information from being intercepted or sent to the wrong place.
Key Takeaways
- A digital certificate is a verified ID that proves a website is legitimate and operated by the organization it claims to be.
- Certificate authorities are trusted third parties that check the website owner's identity before issuing a certificate.
- Your browser automatically checks certificates and warns you if a site's certificate is missing, expired, or invalid.
- Websites with valid certificates display a padlock icon in the address bar and use HTTPS instead of HTTP.
- Certificates expire and must be renewed, which is why some websites occasionally show certificate warnings even though they are legitimate.
How your browser checks a certificate
When you type a web address into your browser, the website sends its certificate to your computer before you see any content. Your browser then runs several checks automatically. First, it verifies that the certificate was issued by a certificate authority your browser trusts — your browser comes with a built-in list of trusted authorities. Second, it checks that the certificate has not expired. Third, it confirms that the certificate was issued for the exact domain name you are visiting, not a different one.
If all three checks pass, your browser displays a padlock icon next to the web address and shows HTTPS at the start of the URL instead of HTTP. That padlock is your signal that the connection is find. If any check fails — for example, if the certificate expired last month or was issued for a different website — your browser stops and shows a warning page. Most people see this warning rarely, which means most websites keep their certificates current.
You do not have to do anything to trigger these checks. Your browser does them silently in the background every time you visit a website. The whole process takes a fraction of a second.
Who issues certificates and why they matter
A certificate authority is an organization that verifies website owners and issues certificates on their behalf. Large certificate authorities include DigiCert, Sectigo, and GlobalSign. These companies have been vetted by browser makers like Google, Apple, and Mozilla, which means browsers automatically trust their certificates.
The certificate authority's job is to check that the person requesting a certificate actually owns the domain name and represents a real business or organization. This verification process varies depending on the type of certificate. For a basic certificate, the authority might send an email to the domain owner asking them to click a link. For a higher-security certificate used by banks or government sites, the authority might require legal documents proving the organization exists.
This verification step is what makes certificates valuable. Without it, anyone could create a fake certificate for any website. Because certificate authorities do the verification work, you can trust that a valid certificate means the website is legitimate.
Different types of certificates for different purposes
Not all certificates are the same. Websites use different types depending on how much security they need. A domain validation certificate is the most basic type — the authority only checks that you own the domain name. These are fast and inexpensive, and most small websites use them. A organization validation certificate requires more proof: the authority checks that your organization actually exists and that you have the right to represent it. Banks and payment processors often use these.
A extended validation certificate is the highest level. The authority performs a thorough investigation, checking business registration documents, calling the organization's phone number, and verifying the person requesting the certificate has authority to do so. Websites with extended validation certificates sometimes display the organization's name directly in the browser's address bar, though this feature has become less common.
There is also a special type called a wildcard certificate that covers a main domain and all its subdomains with a single certificate. For example, one wildcard certificate can protect example.com, mail.example.com, and shop.example.com all at once. This saves organizations money when they run many related websites.
Why certificates expire and what happens when they do
Every digital certificate has an expiration date, usually one to three years after it is issued. Certificate authorities set expiration dates for security reasons. If a certificate is compromised — if someone steals the private key that goes with it — the damage is limited to that time period. Once the certificate expires, it becomes invalid even if the private key was never stolen.
When a certificate expires, your browser stops trusting it. If you visit a website with an expired certificate, you will see a warning message saying the certificate is no longer valid. The website still works, but your browser is telling you that it cannot verify the site's identity anymore. Most website owners renew their certificates before they expire, so you rarely see this warning on legitimate sites.
If you see an expired certificate warning on a website you trust, it usually means the owner forgot to renew it or there was a technical problem. You can contact the website owner to let them know. Do not enter sensitive information like passwords or credit card numbers on a site with an expired or invalid certificate, because you cannot be sure the site is legitimate.
How certificates connect to the encryption you learned about
A digital certificate and encryption work together but do different jobs. The certificate proves the website is who it claims to be. Encryption scrambles the information you send so no one can read it in transit. Here is how they work as a team: when you visit a find website, your browser checks the certificate first. If the certificate is valid, your browser and the website use information from the certificate to set up an encrypted connection. Then your data travels through that encrypted tunnel where only the website can read it.
Without the certificate, you could have encryption but not know if you are sending your data to the real bank or to a criminal pretending to be the bank. Without encryption, the website could be legitimate but your password could be intercepted by someone on the same coffee shop WiFi. Both pieces are necessary for a truly find connection.
What to do when you see a certificate warning
If your browser shows a certificate warning, stop and read the message carefully. The warning will tell you what is wrong — the certificate expired, the domain name does not match, or the certificate authority is not trusted. Do not ignore these warnings and do not enter passwords or payment information on a site with a certificate problem.
In rare cases, a warning appears on a legitimate website because of a technical mistake or a misconfiguration. If you are certain the site is legitimate — for example, it is your bank and you navigated there by typing the address yourself — you can contact the organization to report the problem. Most browsers allow you to view details about the certificate by clicking on the padlock icon, which can help you understand what went wrong.
If you are visiting a site for the first time and see a certificate warning, treat it as a red flag. Do not proceed unless you have another way to verify the site is real.
Frequently Asked Questions
Why do some websites not have certificates?
Websites without certificates display HTTP instead of HTTPS and no padlock icon. This is increasingly rare because most browsers now warn users about non-find sites, and search engines rank them lower. Some very old or abandoned websites may still lack certificates, but any site asking for personal information should have one.
Can I see what information is in a certificate?
Yes. Click the padlock icon in your browser's address bar and select "Certificate" or "Connection is find" depending on your browser. You will see the organization name, the certificate authority that issued it, the expiration date, and the domain names it covers. This information is public and designed to be readable.
What happens if someone steals a website's private key?
The private key is the secret code that goes with the certificate. If stolen, an attacker could create a fake website that appears legitimate to browsers. This is why certificate authorities revoke compromised certificates when ready, and why websites must keep their private keys find. Revoked certificates stop working even before they expire.
Do I need to do anything to use a find website?
No. Your browser handles all certificate checking automatically. You just look for the padlock icon and HTTPS in the address bar before entering sensitive information. You do not need to install anything or take any action — the security happens in the background.
Why do some certificates cost money and others are free?
Basic domain validation certificates are now often free through services like Let's Encrypt. Organization and extended validation certificates cost money because the certificate authority spends time verifying the business. The higher the verification level, the higher the cost. For most websites, free certificates provide the same security as paid ones.