What is a digital certificate?
Definition
A digital certificate is an electronic credential that ties a public key to its owner, such as a website or a person, and is signed by a trusted authority so others can check the owner's identity.
- Category
- Security
- Also called
- public key certificate, SSL certificate, TLS certificate
- Last updated
A digital certificate works like a passport for a website, a person or a device. NIST's glossary describes a certificate as a credential that carries the owner's public key and other details, signed by a certification authority (CA). The CA's signature is what makes the claim trustworthy.
How it works
When you open a site that starts with https, the site sends your browser its certificate. The browser checks that a CA it trusts signed it, that it hasn't expired and that the name on it matches the site you asked for. If everything checks out, the browser uses the public key inside to set up an encrypted connection. If something is off, you see a full-page warning.
You also meet certificates in email signing, in work VPNs and on company laptops, where they prove the device belongs to your employer.
What a certificate does and doesn't tell you
It tells you the connection is encrypted and that the site holds a certificate for that domain name. It does not tell you the site is honest. Scam sites get valid certificates too, so a padlock on a fake bank page proves nothing about the bank.
Why it matters to you
Certificates are why a stranger on the same coffee-shop wifi can't read your logins in transit. They are also why a warning about an invalid or expired certificate deserves a pause. It can be a harmless misconfiguration, or it can be someone sitting between you and the site.
How to protect yourself
- 1
Treat certificate warnings seriously
If your browser shows a certificate error on a site where you log in or pay, close the page. Don't click through to continue.
- 2
Don't treat the padlock as proof of safety
Check the domain name itself before you enter a password. Type the address yourself or use a saved bookmark instead of following links in messages.
- 3
Keep your browser and system updated
Updates carry the list of certificate authorities your device trusts, including removals of ones that were compromised.
- 4
Never install a certificate you were sent
A certificate installed on your device can let someone read your encrypted traffic. Install one only if your employer's IT team asks and you can confirm it with them.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is a digital certificate used for?
Mostly to prove a website's identity and enable encryption on https connections. It is also used for signing emails, logging into work systems and verifying devices.
Is an SSL certificate the same as a digital certificate?
An SSL or TLS certificate is one kind of digital certificate, the kind used on websites.
Does a padlock mean a site is safe?
No. It means the connection is encrypted and the site has a certificate for its domain. Scam sites can have both.
What happens when a certificate expires?
Browsers show a warning because they can no longer confirm the site's identity. Site owners need to renew it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.