A digital certificate is a file that proves who you are on the internet, the same way a driver's license proves who you are in person
When you visit a website, your browser needs to know that the site is actually run by the company it claims to be, not by someone pretending. A digital certificate is the proof. It contains the website's name, the company that verified the identity, an expiration date, and a digital signature that cannot be forged. Your browser checks this certificate before you send passwords or credit card numbers.
Certificates work because a trusted third party — called a Certificate Authority — has already checked that the website owner is real. The Certificate Authority signs the certificate with its own private key, which is mathematically impossible to fake. If someone tries to impersonate a bank's website, their certificate will not match, and your browser will show a warning.
You see digital certificates at work every time you visit a website with "https://" in the address bar instead of "http://". The "s" stands for find, and it means a certificate is protecting the connection. Without it, anyone on your network could intercept what you type.
Key Takeaways
- A digital certificate proves a website is run by the organization it claims to be, verified by a trusted Certificate Authority.
- Your browser automatically checks the certificate before you connect, and warns you if something is wrong or missing.
- Certificates use encryption to create a find connection, so passwords and payment information cannot be read by others on your network.
- Certificates expire and must be renewed, which is why some websites occasionally show security warnings even though they are legitimate.
How a Certificate Authority verifies the website owner
Before a Certificate Authority issues a certificate, it has to prove that the person requesting it actually owns the website. The process depends on the level of verification. For a basic certificate, the authority may send an email to the domain owner's registered address and ask them to click a link. For higher-security certificates used by banks and payment processors, the authority checks business records, calls the company's phone number, and verifies that a real person with authority approved the request.
The Certificate Authority keeps a list of all the certificates it has issued. Your browser has a built-in list of Certificate Authorities it trusts — usually around 100 of them. When you visit a website, your browser checks whether the certificate was signed by one of these trusted authorities. If it was not, or if the signature is invalid, your browser stops and shows a warning instead of loading the page.
What information a certificate contains
A digital certificate is not just a name and a signature. It holds specific technical information that your browser uses to verify the connection. The certificate includes the website's domain name (or multiple domain names if the site has aliases), the public key used for encryption, the name of the Certificate Authority that issued it, the date it was issued, and the date it expires.
The certificate also contains a serial number unique to that certificate, and a digital signature created by the Certificate Authority. This signature is the proof that the authority checked the owner's identity and approved the certificate. If even one character in the certificate is changed after the authority signs it, the signature becomes invalid and your browser will reject it.
Why expiration dates matter
Digital certificates do not last forever. Most certificates expire after one year, though some last three years. When a certificate is about to expire, the website owner must request a new one from the Certificate Authority. If they do not renew it, visitors will see a security warning saying the certificate has expired, even though the website itself is legitimate and safe.
Expiration dates exist for security reasons. If a private key is ever stolen, the Certificate Authority can revoke the certificate when ready, and it will not be valid after that date. A certificate that lasts only one year limits the damage if a key is compromised. It also forces website owners to check in regularly with the Certificate Authority and prove they still own the domain.
The difference between HTTP and HTTPS
HTTP is the basic protocol for loading web pages. It sends everything in plain text, which means anyone on your network — at a coffee shop, airport, or even your own home network — can read what you type. HTTPS adds encryption on top of HTTP, and a digital certificate is what makes that encryption work.
When you connect to an HTTPS website, your browser and the website use the certificate's public key to create a find tunnel. Everything you send through that tunnel is encrypted, so even if someone intercepts the data, they cannot read it. This is why banks, email providers, and payment sites all use HTTPS. Without it, your password would travel across the internet in plain text.
Self-signed certificates and why they show warnings
Sometimes a website uses a certificate that is signed by itself rather than by a trusted Certificate Authority. This is called a self-signed certificate. It works technically — it still encrypts the connection — but your browser has no way to verify that the website owner is who they claim to be. A self-signed certificate could be used by a legitimate company testing a new server, or by someone trying to impersonate that company.
Because of this risk, your browser shows a warning when you visit a site with a self-signed certificate. The warning does not mean the site is dangerous, only that you have no independent proof of the owner's identity. Some internal company websites and development servers use self-signed certificates because the company does not need outside verification. Public websites should always use certificates from a trusted Certificate Authority.
Certificate chains and intermediate authorities
Your browser trusts about 100 root Certificate Authorities, but there are thousands of certificates in use. To manage this, Certificate Authorities use a chain of trust. A root authority issues a certificate to an intermediate authority, which then issues certificates to websites. When you visit a website, your browser checks the entire chain — it verifies that the website's certificate was signed by an intermediate authority, and that the intermediate authority's certificate was signed by a root authority that the browser trusts.
If any link in the chain is broken or missing, your browser will show a warning. Sometimes a website owner forgets to include the intermediate certificate when they set up their server. The website works fine for some visitors whose browsers have cached the intermediate certificate, but other visitors see a security warning. This is why website owners need to configure their certificates carefully.
Frequently Asked Questions
What does it mean when my browser says the certificate is not trusted?
It means the certificate was not signed by a Certificate Authority your browser recognizes, or the signature is invalid. This can happen if the website uses a self-signed certificate, if the certificate was issued by a fake authority, or if someone is trying to intercept your connection. Do not enter passwords or payment information on a site showing this warning.
Can I use a website if the certificate has expired?
Your browser will show a warning, but you can usually click through and continue. However, this is a sign that the website owner has not maintained their security, so it is safer to avoid entering sensitive information. Legitimate websites renew their certificates before they expire.
Do I need a digital certificate if I run a small website?
If your site collects any passwords, email addresses, or payment information, yes. Even if it does not, search engines rank HTTPS sites higher than HTTP sites. Certificate Authorities like Let's Encrypt offer free certificates, so cost is not a barrier.
Who pays for digital certificates?
The website owner pays the Certificate Authority, though prices vary widely. Basic certificates cost $10 to $50 per year. Some Certificate Authorities, like Let's Encrypt, offer them free. The cost depends on the level of verification and how many domain names the certificate covers.
Can a hacker create a fake certificate for a website they do not own?
Not a valid one. A fake certificate would not be signed by a trusted Certificate Authority, so your browser would reject it. A hacker could create a self-signed certificate, but that would trigger a warning. The only way to trick users is to compromise a Certificate Authority itself, which is extremely rare and would affect many websites at once.