What is digital certificate? Plain-English meaning

Short definition: A digital certificate is an electronic credential that verifies the identity of a website or other entity and enables encrypted communication over the internet.

Plain-English explanation

Think of a digital certificate like an ID card for a website. When you visit a site that uses HTTPS, the site presents its certificate to your browser. The certificate contains the site's public key and identity information, and it is signed by a trusted authority. Your browser checks the signature and confirms the site is who it claims to be, then uses the certificate to set up an encrypted connection. This ensures that data you send is private and that you are communicating with the intended site.

Why it matters

Digital certificates are the foundation of secure online communication. Without them, an attacker could intercept your connection and impersonate a legitimate website to steal passwords, credit card numbers, or other sensitive information. Understanding certificates helps you recognize secure sites and appreciate why HTTPS matters.

Concrete example

When you log in to your online banking site, the address bar shows a padlock icon and the URL starts with https://. Your browser receives the bank's digital certificate, checks that it was issued by a trusted certificate authority, and then uses the certificate's public key to encrypt the data you send. This prevents anyone on the same network from reading your login credentials.

Common confusion

People often confuse a digital certificate with the HTTPS protocol itself. HTTPS is the secure communication protocol, while the digital certificate is the identity credential that makes HTTPS possible. Another confusion is between SSL and TLS: SSL is the older protocol, and TLS is the modern replacement, but the term 'SSL certificate' is still commonly used.

Related terms

HTTPS, Encryption, Certificate Authority, Public Key Infrastructure, TLS

How people actually use it

Digital certificates are used in TLS/SSL protocols to secure websites, in email signing and encryption, and in code signing to verify software authenticity. They are issued by certificate authorities and presented during handshakes.

Related terms explained

public key infrastructure (PKI)

PKI is the framework of policies, procedures, and technologies that manages digital certificates and public-key encryption. It includes certificate authorities, registration authorities, and certificate revocation lists.

Example: A company deploying an internal PKI to issue certificates for its employees' devices.

certificate authority (CA)

A certificate authority is a trusted entity that issues and digitally signs digital certificates. It verifies the identity of certificate applicants before issuance.

Example: Comodo or DigiCert acting as a CA for HTTPS certificates.

TLS/SSL

TLS (Transport Layer Security) and its predecessor SSL are cryptographic protocols that secure communications over a network. Digital certificates are used in these protocols to authenticate the server and establish an encrypted session.

Example: A web browser verifying a website's TLS certificate before showing a padlock icon.

digital signature

A digital signature is a mathematical scheme for verifying the authenticity and integrity of digital messages or documents. It uses the signer's private key and is verified with the corresponding public key, often embedded in a certificate.

Example: Signing a PDF contract with a digital signature to prove the signer's identity.

Practical tips

Array

Common questions

Array

Key takeaways

Array

Step by step

Array

More context

Digital certificates are used not only for websites but also for email signatures, code signing, and device authentication. The security of the entire system depends on the security of the private key and the trustworthiness of CAs. There are different types of certificates, such as domain-validated (DV) and extended validation (EV), which provide different levels of assurance.

Additional background

The concept of digital certificates dates back to the early days of public-key cryptography, but they became widely used with the rise of e-commerce in the 1990s. A certificate authority is an organization that verifies the identity of the certificate requester and then signs the certificate. Browsers come with a pre-installed list of trusted root CAs, and if a certificate is not signed by one of them, the browser will show a warning. Certificates have a limited lifetime—typically one to two years—to reduce the risk of compromised keys. There are different types of certificates: domain validation (DV) only proves domain ownership, organization validation (OV) verifies the organization’s legal identity, and extended validation (EV) gives the highest level of trust and shows the organization’s name in the address bar. In recent years, the industry has moved toward shorter-lived certificates and automated issuance, such as with the ACME protocol, to enhance security.