What is SSL certificate? Plain-English meaning

Short definition: An SSL certificate is a digital file that verifies a website's identity and enables an encrypted HTTPS connection between a browser and the site.

Plain-English explanation

When you visit a website that uses an SSL certificate, your browser and the website exchange a secure, encrypted connection. This means the data you send, like passwords or credit card numbers, is scrambled so that anyone who intercepts it cannot read it. The certificate also proves that the website is actually the one it claims to be, helping to prevent impostor sites. You can usually tell a site has an SSL certificate when the address starts with HTTPS and shows a padlock icon. SSL is the older name, but the modern protocol is called TLS; people still commonly say SSL.

Why it matters

You should understand SSL certificates because they protect your personal information when you shop, log in, or enter sensitive details online. Without them, a hacker could intercept your data on an unsecured connection. Also, knowing how to check for HTTPS helps you avoid phishing sites and use the internet more safely.

Concrete example

When you buy a book from an online store, your browser checks the store's SSL certificate. If the certificate is valid, the browser displays HTTPS and a padlock. Your credit card number is then encrypted before being sent, so even if a network eavesdropper captures the data, they only see gibberish.

Common confusion

Many people confuse SSL certificates with HTTPS itself. HTTPS is the secure protocol, while the SSL certificate is the digital file that makes HTTPS work. A certificate is not a firewall or antivirus; it only secures the connection and verifies identity, not the site's content or safety.

Related terms

HTTPS, TLS, Encryption, Public key infrastructure, Certificate authority

How people actually use it

Website owners install SSL certificates to enable HTTPS, which is indicated by a padlock icon in the browser. This is standard practice for any site that handles login credentials, payments, or personal information.

Related terms explained

Encryption

Encryption is the process of converting plain text into a coded format that only authorized parties can decode. It protects data during transmission or storage.

Example: Scrambling a credit card number before sending it over the internet.

HTTPS

HTTPS is a protocol that uses SSL/TLS to encrypt data exchanged between a web server and a browser. It is the secure version of HTTP and is now the default for most websites.

Example: Visiting 'https://example.com' to submit a form securely.

Public key infrastructure (PKI)

PKI is a framework that manages digital keys and certificates for secure communications. It includes the issuance, revocation, and validation of certificates.

Example: A certificate authority issuing a certificate for a website.

Certificate authority (CA)

A certificate authority is an organization that issues and verifies digital certificates. It acts as a trusted third party to confirm the identity of certificate holders.

Example: A browser trusting a certificate issued by a well-known CA.

Practical tips

Array

Common questions

Array

Key takeaways

Array

Step by step

Array

More context

SSL certificates use public-key cryptography to establish a secure connection. The padlock icon in browsers indicates that the certificate is valid and the connection is encrypted. Without SSL, data like passwords and credit card numbers can be intercepted by attackers on the network.

Additional background

SSL certificates are digital certificates that authenticate a website's identity and enable an encrypted connection. They are issued by Certificate Authorities (CAs), which are trusted entities that verify the applicant's ownership of the domain. The encryption process uses a public key and a private key, where the public key is shared with the user's browser and the private key remains secret on the server. When a user visits a site with SSL, the browser and server perform a handshake to establish a secure session. There are several types of SSL certificates, including Domain Validation (DV), Organization Validation (OV), and Extended Validation (EV), which differ in the level of vetting required. DV certificates are the most common and are issued quickly, often automatically. OV and EV provide more assurance to users but require more documentation. SSL certificates have a validity period, typically one to two years, and must be renewed. The security of SSL depends on the strength of the encryption algorithms and the protection of the private key. Without SSL, data sent over the internet is in plain text and can be intercepted by attackers. SSL is also a ranking factor in search engines, so having it can benefit SEO.