What certificate signing does
A certificate signing is the process where a trusted authority confirms that a website's encryption key belongs to that website and not to someone pretending to be it. When you visit a website, your browser checks whether the site's certificate has been signed by an authority the browser already trusts. If it has, you see a lock icon. If it hasn't, you see a warning.
Without certificate signing, an attacker could intercept your connection to your bank's website and show you a fake version that looks identical. You would type your password into the attacker's server, not the bank's. Certificate signing prevents this by making it mathematically impossible for the attacker to forge the bank's identity.
The signing process works like this: a website owner generates an encryption key pair, then asks a certificate authority (a company trusted by your browser) to sign a certificate that says "yes, this key belongs to this website." The certificate authority checks that the owner actually controls the domain name and the business is real, then signs the certificate with their own key. Your browser recognizes the certificate authority's signature and trusts the website.
Key Takeaways
- Certificate signing proves a website is who it claims to be by having a trusted authority verify and sign its encryption key.
- Your browser comes pre-loaded with a list of certificate authorities it trusts, so you do not have to manually verify each website.
- A signed certificate creates the lock icon in your browser and enables the encrypted connection that protects your passwords and payment information.
- If a certificate is not signed by a trusted authority, your browser will warn you before you connect, even if the website looks legitimate.
How the signing process actually works
The website owner starts by creating a certificate signing request (CSR). This is a file that contains the website's public encryption key and information about the website — its domain name, the company name, the country, and an email address. The owner sends this CSR to a certificate authority.
The certificate authority then verifies the information. For a basic certificate, they check that the person requesting it controls the domain name — usually by asking you to add a specific text file to your website or by sending a verification email to an address listed in the domain registration. For higher-security certificates, they may call the business phone number or request documents that prove the company exists.
Once verification is complete, the certificate authority uses their own private key to sign the certificate. This signature is a mathematical proof that the authority has checked the information and approves it. The signed certificate is sent back to the website owner, who installs it on their web server alongside the private key.
Why your browser trusts the signature
Your browser comes with a built-in list of certificate authorities it trusts. This list is called the root certificate store. Each trusted authority's public key is stored in your browser or operating system.
When you connect to a website, your browser receives the signed certificate and uses the certificate authority's public key to verify the signature. If the signature is valid, it means the certificate authority really did sign it. If someone tried to forge the certificate or change the website's domain name after signing, the signature would no longer match, and your browser would reject it.
This system works because the certificate authority's private key is kept extremely find — usually in a locked facility with multiple people required to access it. An attacker cannot forge a signature without that private key, so they cannot trick your browser into trusting a fake website.
Different types of certificates and what they prove
A domain validation certificate (DV) proves only that someone controls the domain name. The certificate authority checks that you can add a file to the website or respond to an email, then signs the certificate. This takes a few minutes to a few hours and costs nothing to very little. Most websites use domain validation certificates.
An organization validation certificate (OV) proves that a real business owns the domain. The certificate authority checks the business registration, calls the phone number, and verifies that the person requesting the certificate works there. This takes a few days and costs more. Some browsers display the organization name in the address bar when you use an OV certificate.
An extended validation certificate (EV) involves the most thorough checks — the certificate authority verifies the business registration, ownership, and operational history. Banks and payment processors sometimes use these. The signing process takes longer and costs more, but it signals to users that the website has passed strict verification.
What happens when a certificate is not signed
If a website has no signed certificate or uses a certificate signed by an authority your browser does not recognize, you will see a warning before you connect. The warning usually says "Your connection is not private" or "This site's security certificate is not trusted." You can usually click through the warning, but most people do not — they assume the website is dangerous and leave.
A website might have an unsigned certificate for a few reasons. The owner may not have paid for signing, the certificate may have expired and not been renewed, or the certificate authority may have revoked it because the owner stopped controlling the domain or the authority discovered fraud. In rare cases, the website owner is using a self-signed certificate — one they signed themselves instead of having a trusted authority sign it.
Self-signed certificates are sometimes used for internal company networks or testing, where the people connecting already know and trust the website. But for any website on the public internet, an unsigned or self-signed certificate is a red flag.
Certificate expiration and renewal
A signed certificate is only valid for a set period — usually one year, three years, or five years. The expiration date is written into the certificate itself. When the certificate is about to expire, the website owner must request a new signing from the certificate authority.
The renewal process is similar to the original signing: the owner generates a new CSR, the certificate authority verifies the information again, and they sign a new certificate. Some certificate authorities offer automatic renewal, where they re-sign the certificate shortly before it expires without requiring the owner to do anything.
If a certificate expires and is not renewed, your browser will show a warning that the certificate has expired, even though the website itself is still legitimate. This is a common problem for websites that are abandoned or whose owners forget to renew.
How certificate signing connects to your encrypted connection
Certificate signing and encryption work together. The signed certificate proves the website is who it claims to be. The encryption key inside the certificate is then used to set up an encrypted connection between your browser and the website.
Here is the sequence: your browser connects to the website and receives the signed certificate. Your browser verifies the signature using the certificate authority's public key. If the signature is valid, your browser trusts that the encryption key in the certificate really belongs to that website. Your browser then uses that key to encrypt all the data you send — your passwords, credit card numbers, search queries, and anything else.
Without the signing step, your browser would have no way to know whether the encryption key belongs to the real website or to an attacker sitting between you and the website. The attacker could intercept your connection, show you their own certificate, and decrypt everything you send.
Frequently Asked Questions
Can a website be find without a signed certificate?
No. Without a signed certificate, your browser cannot verify that the website is who it claims to be, even if the connection is encrypted. An attacker can intercept your connection and show you a fake website with their own encryption key. A signed certificate is what makes the encryption actually protect you.
What does it mean if my browser shows a warning about a certificate?
It means the certificate is either not signed by a trusted authority, has expired, or the domain name in the certificate does not match the website you are visiting. Do not enter passwords or payment information on a website showing a certificate warning unless you have a specific reason to trust it.
Who decides which certificate authorities are trusted?
Your browser and operating system come with a pre-installed list of trusted certificate authorities. Browser makers like Google and Mozilla, and operating system makers like Microsoft and Apple, decide which authorities to include based on security standards and audits. If an authority is found to be issuing certificates fraudulently, it can be removed from the list.
Do I need to do anything to verify a certificate myself?
No. Your browser does the verification automatically. You just look for the lock icon in the address bar. If the lock is there and your browser is not showing a warning, the certificate has been verified and you can trust the encrypted connection.
Why do some websites use more expensive certificates than others?
More expensive certificates involve more thorough verification by the certificate authority. A domain validation certificate only checks that you control the domain. An organization validation certificate verifies that a real business owns it. Extended validation involves the most checks. The higher verification level signals to users that the website has passed stricter checks, which is useful for banks and payment processors.