What is an SSL certificate?

An SSL (Secure Sockets Layer) certificate is a digital certificate that authenticates a website's identity and enables encrypted connections. It ensures data transmitted between browser and server remains private and tamper-proof.

What is the difference between DV, OV, and EV certificates?

DV (Domain Validated) verifies domain ownership only. OV (Organization Validated) also verifies the organization behind the domain. EV (Extended Validation) requires the most rigorous identity checks and displays the organization name in the browser address bar.

What is a certificate trust chain?

A trust chain links your domain's certificate to a trusted Root CA through intermediate certificates. The browser checks that each certificate in the chain is valid and signed by the entity above it, ending at a root certificate pre-installed in the browser.

How does the TLS handshake work?

The TLS handshake involves: (1) Client Hello with supported cipher suites, (2) Server Hello with chosen cipher and certificate, (3) Client verifies the certificate, (4) Key exchange to create a shared session key, (5) Both sides switch to encrypted communication.

Is SSL the same as TLS?

SSL (Secure Sockets Layer) is the older protocol; TLS (Transport Layer Security) is its modern successor. All current certificates use TLS, though the term 'SSL certificate' is still commonly used. SSL 3.0 was deprecated in 2015 due to security vulnerabilities.

🔒 SSL Certificate Explainer

Overview

Certificate Types

Trust Chain

TLS Handshake

Cert Decoder

Security Checklist

What is an SSL/TLS Certificate?

An SSL (Secure Sockets Layer) certificate is a digital data file that binds a cryptographic key to an organization's details. When installed on a web server, it activates the HTTPS protocol and padlock, enabling secure, encrypted connections between the browser and the server.

TLS (Transport Layer Security) is the modern successor to SSL. Although the term "SSL certificate" is still widely used, all modern certificates actually use TLS. SSL 3.0 was deprecated in 2015 due to known vulnerabilities (POODLE attack).

🔐 Encryption

Encrypts data in transit using AES-256 or stronger. Prevents eavesdropping and man-in-the-middle attacks.

✅ Authentication

Verifies that the website belongs to the claimed organization, not an impostor.

📋 Integrity

Ensures data hasn't been tampered with during transmission using hash-based message authentication.

🌍 Trust

Issued by trusted Certificate Authorities (CAs) pre-installed in browsers and operating systems.

Key Components of an SSL Certificate

Subject: The domain name the certificate is issued for (e.g., example.com)
Issuer: The Certificate Authority that issued it (e.g., Let's Encrypt, DigiCert)
Valid From / To: The certificate's validity period
Public Key: Used for encrypting data sent to the server
Signature: The CA's digital signature validating the certificate
Serial Number: Unique identifier for the certificate
San (Subject Alternative Names): Additional domains covered by the certificate

How HTTPS Works (Simplified)

When you visit an HTTPS site, your browser and the server perform a TLS handshake. They agree on encryption parameters, the server proves its identity with the certificate, and a secure encrypted tunnel is established. All subsequent data flows through this tunnel, unreadable to interceptors.

Certificate Validation Types

SSL certificates come in three levels of identity verification:

Feature	DV (Domain Validated)	OV (Organization Validated)	EV (Extended Validation)
Verification Level	Basic	Standard	Rigorous
What's Verified	Domain ownership only	Domain + Organization identity	Domain + Full legal + physical + operational verification
Time to Issue	Minutes (automated)	1–3 business days	3–7 business days
Shows in Browser	Padlock icon	Padlock icon + org in cert details	Padlock + organization name in address bar (historically green bar)
Cost Range	Free – $50/yr	$50 – $300/yr	$150 – $500+/yr
Best For	Personal sites, blogs, dev	Business sites, e-commerce	Financial, enterprise, high-trust
Examples	Let's Encrypt, Cloudflare	DigiCert, GlobalSign, Sectigo	DigiCert EV, Symantec EV

Other Certificate Categories

Single Domain: Protects one FQDN (e.g., www.example.com)
Wildcard: Covers a domain and all subdomains (*.example.com)
Multi-Domain (SAN/UCC): Covers multiple domains in one certificate
Code Signing: Authenticates software and scripts
Email (S/MIME): Encrypts and signs email communications
IoT/Device: Certificates for IoT devices and machine-to-machine communication

Certificate Trust Chain

A certificate trust chain (or certificate path) is a linked sequence of certificates from the server's leaf certificate up to a trusted Root CA. Your browser validates this chain to establish trust.

Root Certificate

Trusted Root CA

Pre-installed in browsers/OS. Self-signed. E.g., DigiCert Global Root CA

▼ signed by

Intermediate Certificate

Intermediate CA

Bridges root and leaf. May have 1–3 levels. E.g., DigiCert SHA2 Secure Server CA

▼ signed by

Leaf / End-Entity Certificate

example.com

Your domain's certificate. Contains your public key and domain details

How Chain Validation Works

The browser receives the server's leaf certificate
It checks the certificate's validity period and signature
It follows the issuer chain upward, checking each intermediate
It verifies the final link to a Root CA in its trust store
If any link is broken, expired, or untrusted, the connection is rejected

Common Chain Issues

Missing Intermediate: The server didn't send the full chain. Browser can't build the path. Fix: Install the full certificate bundle.
Expired Intermediate: An intermediate certificate has expired. Fix: Renew with the CA.
Self-Signed: No CA backs the certificate. Browsers show a warning. Only for internal/dev use.
Name Mismatch: The domain doesn't match the certificate's Subject/SAN. Fix: Get the right certificate.

🔗 Chain Length

Typically 2–4 certificates: Root → 1–2 Intermediates → Leaf

📦 Full Chain Bundle

Servers should serve the leaf + all intermediates. The root is already known by browsers.

🔄 Cross-Signing

Some CAs cross-sign intermediates with multiple roots for broader compatibility.

TLS 1.3 Handshake (Interactive)

Click Play to step through the TLS 1.3 handshake. This is the modern, streamlined version (1 round-trip vs 2 in TLS 1.2).

CLIENT → SERVER

Client Hello

Browser sends: supported TLS version (1.3), cipher suites, supported groups, key share, and a random number.

SERVER → CLIENT

Server Hello

Server responds: chosen cipher suite, its key share, a random number, and optionally early data extension.

SERVER → CLIENT

Certificate + Certificate Verify

Server sends its SSL certificate chain. The client validates the trust chain and checks the domain matches.

SERVER → CLIENT

Server Finished

Server sends a Finished message encrypted with the derived key, confirming the handshake parameters.

CLIENT → SERVER

Client Finished + Application Data

Client sends its Finished message. The handshake is complete! Both sides now communicate using symmetric encryption (AES-256-GCM).

⏱ TLS 1.3 Speed

1-RTT (one round-trip) handshake, down from 2-RTT in TLS 1.2. 0-RTT available for repeat visitors.

🚫 TLS 1.3 Removed

Removed: RSA key exchange, SHA-1, MD5, RC4, DES, 3DES, compressions, non-AEAD ciphers.

🔐 Forward Secrecy

All TLS 1.3 handshakes provide forward secrecy — compromising long-term keys doesn't decrypt past sessions.

Certificate Decoder

Check the SSL certificate of any HTTPS website directly from your browser. This uses the browser's built-in TLS stack — no external API calls.

How to Read a Certificate

Subject (CN): The primary domain name
Subject Alternative Names (SAN): All domains covered (including www.)
Issuer (O): The Certificate Authority
Valid From / To: Certificate validity window
Serial Number: Unique CA-assigned identifier
Signature Algorithm: e.g., SHA256withRSA
Public Key: RSA 2048-bit, ECDSA P-256, etc.

SSL/TLS Security Checklist

Use this interactive checklist to audit your site's SSL/TLS configuration:

Checklist Progress 0 / 12

Quick Testing Commands

# Test SSL with OpenSSL (run in terminal)

openssl s_client -connect example.com:443 -servername example.com

# Check certificate details

echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -text