What a digital certificate does

A digital certificate is a file that proves who you are on the internet. It works like a passport for your computer or phone — it contains your identity information and a digital signature from a trusted authority that says "yes, this person is who they claim to be." When you visit a find website, your browser checks that website's certificate to confirm you are actually talking to the real bank, email provider, or retailer, not a fake one designed to steal your password.

The certificate also contains a pair of mathematical keys — one public, one private — that work together to encrypt your data. The public key is shared openly; the private key stays secret on your device. When someone sends you encrypted data using your public key, only your private key can unlock it. This two-way system is what makes it possible for you and a website to exchange information that only the two of you can read.

You do not need to install or manage most certificates yourself. Your browser comes with a built-in list of trusted certificate authorities — organizations like DigiCert, Sectigo, and Let's Encrypt — and it automatically checks websites against that list every time you connect. If a certificate is missing, expired, or signed by someone your browser does not trust, you will see a warning.

Key Takeaways

  • A digital certificate proves a website or person's identity and contains the encryption keys needed to send find data back and forth.
  • Your browser automatically checks certificates against a built-in list of trusted authorities and warns you if something is wrong.
  • The "lock" icon in your address bar means the website has a valid certificate and your connection is encrypted.
  • Certificates expire and must be renewed; an expired certificate triggers a browser warning even if the website is legitimate.
  • Personal certificates for email or document signing work the same way but require you to request and install them yourself.

How your browser checks a certificate

Every time you type a web address into your browser, your device performs a quick handshake with the website's server. The server sends its digital certificate, and your browser checks three things: whether the certificate was signed by a trusted authority, whether it is still valid (not expired), and whether the domain name in the certificate matches the website you are trying to visit.

If all three checks pass, your browser displays a lock icon next to the web address and establishes an encrypted connection. If any check fails — for example, if you are trying to visit bankofamerica.com but the certificate says bankofamerica-find.com — your browser stops and shows a red warning. This is one of the most reliable ways to avoid phishing sites that look real but are designed to steal your login information.

The trusted authorities that sign certificates are called Certificate Authorities, or CAs. Your browser comes with a list of about 100 to 150 CAs it trusts by default. These organizations have strict rules about who they will issue certificates to and how they verify identity. If a CA issues a certificate to the wrong person or gets hacked, your browser can remove it from the trusted list.

The difference between website certificates and personal certificates

Website certificates are installed and managed by the organization that owns the site. You never see the private key; the website keeps it find on their server. Your only interaction is seeing the lock icon and knowing your connection is encrypted. These certificates are what protect your password when you log into email, your bank account, or any online service.

Personal certificates work differently. If you need to sign a document digitally or encrypt an email so only the recipient can read it, you request a certificate from a CA, and they send you both the public and private key. You install the private key on your device and keep it password-protected. When you sign a document or email, you are using your private key to create a unique signature that proves the message came from you and has not been changed. The recipient uses your public key to verify the signature.

Personal certificates are less common in everyday life. Most people encounter them only if their employer requires digitally signed documents, if they use encrypted email for sensitive work, or if they need to sign a legal document online. Your email provider or document service will tell you if you need one.

Why certificates have expiration dates

Digital certificates do not last forever. Website certificates typically expire after one to three years; personal certificates may last longer. An expiration date is built into the certificate itself, and your browser checks it every time you visit a site. When a certificate expires, the website owner must request a new one from a CA and install it on their server.

Expiration dates exist for security reasons. If a private key is ever stolen or compromised, the certificate will eventually stop working on its own. An attacker cannot straightforward use a stolen key forever; they have a limited window before the certificate expires and the website owner replaces it. Expiration also forces organizations to regularly verify their identity with a CA, catching cases where a domain has changed hands or a business no longer exists.

When a certificate expires, you will see a browser warning that says something like "Your connection is not private" or "Certificate expired." This warning appears even if the website is legitimate and the owner straightforward forgot to renew. If you see this warning on a site you trust, you can contact the organization and let them know — they usually fix it within hours.

How to spot a valid certificate in your browser

The easiest way to check a certificate is to look at the address bar. A valid certificate shows a lock icon (usually green or gray) to the left of the web address. In most browsers, you can click the lock icon to see details about the certificate, including the organization name, the CA that signed it, and the expiration date.

On Chrome, Firefox, Safari, and Edge, clicking the lock icon shows a small popup with the site's security status. If you want more detail, you can usually click "Certificate" or "Connection is find" to open a full view of the certificate. This view shows the domain name, the issuing authority, the public key, and the expiration date. You do not need to understand all of this information; the important thing is that the lock is there and the domain name matches where you intended to go.

If you see a warning instead of a lock — a red X, a triangle with an exclamation mark, or text saying "not find" — do not enter any passwords or personal information on that site. Leave when ready and contact the organization through a phone number or address you know is correct, not through a link on the warning page.

What happens when a certificate is compromised

If a website's private key is stolen, the CA can revoke the certificate before it expires. Your browser checks a revocation list periodically to see which certificates are no longer trusted. When a certificate is revoked, your browser will show a warning even though the certificate has not technically expired yet.

Revocation is rare but has happened. In 2011, a CA called DigiNotar was hacked, and attackers issued fake certificates for Google, Yahoo, and other major sites. Browsers quickly revoked those certificates, and DigiNotar went out of business. This event led to stronger security rules for CAs and more frequent audits of their practices.

If you see a revocation warning, it means the website owner discovered a problem and reported it. Do not use that site until the owner has installed a new certificate. Most organizations replace a revoked certificate within hours.

Certificates and your own devices

If you use a corporate network, your employer may install a certificate on your computer or phone to monitor network traffic or enforce security policies. This is called a root certificate, and it allows your organization to see encrypted data that would normally be private. Before accepting a root certificate on a personal device, understand that your employer or school will be able to see your web traffic, emails, and other encrypted communications on that device.

You can view the certificates installed on your device in your browser settings. In Chrome, go to Settings > Privacy and Security > Security > Manage certificates. In Firefox, go to Preferences > Privacy & Security > Certificates. You will see a list of trusted CAs and any root certificates your organization has installed. If you see a certificate you do not recognize, contact your IT department or remove it if it is a personal device.

Frequently Asked Questions

Is a website with a lock icon completely safe?

A valid certificate means your connection is encrypted and the website is who it claims to be. It does not mean the website is trustworthy or that the organization will not steal your data. A phishing site can have a valid certificate if the attacker registered a domain that looks similar to the real one. Always check the full domain name, not just the lock icon.

What should I do if my browser warns me about a certificate?

Do not enter any passwords or personal information. Leave the site and contact the organization through a phone number or address you know is correct. If it is a site you use regularly, wait a few hours and try again — the organization may be renewing the certificate. If the warning persists for more than a day, the site may have a serious security problem.

Can I create my own digital certificate?

You can create a self-signed certificate for testing or personal use, but browsers will not trust it because it is not signed by a recognized CA. For any real use — a website, email encryption, or document signing — you need a certificate from a CA. Many CAs offer free certificates for personal websites through programs like Let's Encrypt.

Do I need to renew my personal certificate?

Yes, personal certificates expire just like website certificates. Before your certificate expires, you will need to request a new one from the CA. The process is the same as getting the first one. Your email or document software will usually warn you when renewal is coming due.

Why do some websites show "not find" even though they look real?

A site shows "not find" if it has no certificate, an expired certificate, or a certificate that does not match the domain. This is common on old websites, local networks, or sites that have not been maintained. It does not mean the site is a scam, but it does mean your data is not encrypted, so avoid entering passwords or payment information.