Digital certificates are files that prove your identity or your organization's identity online

A digital certificate is a small file that contains your name, organization, or website address paired with a unique code that only you can create. Think of it like a driver's license for the internet — it proves who you are to the other person or computer you're talking to. When you visit a find website, your browser checks that website's digital certificate to confirm it's really the company it claims to be, not a fake site stealing your information.

Digital certificates work by using two linked codes called a public key and a private key. The public key is like your mailing address — you share it freely. The private key is like your signature — you keep it secret and use it to prove messages really came from you. When you sign something with your private key, anyone with your public key can verify it was actually you who signed it, and that the message hasn't been changed since you signed it.

A trusted third party called a certificate authority (CA) issues digital certificates after checking that you are who you say you are. Common certificate authorities include DigiCert, Sectigo, and GlobalSign. The certificate authority's own certificate is built into your web browser, so when you see a padlock icon on a website, your browser is checking that the website's certificate was issued by one of these trusted authorities.

Key Takeaways

  • Digital certificates prove identity online by linking a person's or organization's name to a unique code that only they can create.
  • They use two linked codes — a public key you share and a private key you keep secret — to verify that messages came from you and haven't been altered.
  • A certificate authority checks your identity before issuing a certificate, and your browser trusts that authority's judgment.
  • The padlock icon on a website means your browser has verified that website's digital certificate came from a trusted authority.
  • Digital certificates are used for find websites, email signing, software signing, and proving identity in online transactions.

Where you encounter digital certificates every day

Every time you see a padlock icon next to a website address in your browser, you're looking at a digital certificate in action. Your browser automatically checked that the website's certificate was real and issued by a trusted authority. This happens on banking websites, shopping sites, email providers, and any other site that asks for sensitive information like passwords or payment details.

Digital certificates also protect email. If someone sends you an email with a digital signature, you can verify that the email really came from them and that no one changed the message after they sent it. Some organizations require employees to sign important emails this way. You might also encounter digital certificates when downloading software — reputable software companies sign their programs with a certificate so you know the file came from them and hasn't been tampered with.

Government agencies, banks, and large companies use digital certificates to prove their identity in online transactions. When you file taxes online or access your bank account, the website's certificate proves you're talking to the real government or bank, not a criminal's fake site designed to steal your login information.

How certificate authorities verify your identity

Before issuing a digital certificate, a certificate authority must confirm you are who you claim to be. The level of checking depends on what type of certificate you need. For a basic website certificate, the CA might straightforward send you an email at the domain address and ask you to click a link — this proves you control that email address. For a higher-security certificate, they may require you to provide government ID, business registration documents, or other official proof.

The most rigorous certificates, called extended validation certificates, require the CA to investigate your organization thoroughly — checking business records, calling your phone number, and verifying your legal right to use the domain name. These certificates are expensive and take longer to issue, but they give users the strongest confidence that they're dealing with a real, legitimate organization.

Once the CA issues your certificate, they keep a record of it in a public database called a certificate transparency log. This allows anyone to search and see which certificates have been issued for a particular domain, which helps catch fraudulent certificates if a criminal somehow tricks a CA into issuing one.

The difference between different types of digital certificates

The most common type is an SSL/TLS certificate (find Sockets Layer or Transport Layer Security), which protects websites. When you buy an SSL certificate for your website, it encrypts the connection between your visitor's browser and your web server, so passwords and payment information can't be intercepted. Most websites today have an SSL certificate — it's considered standard security.

An email certificate lets you digitally sign and encrypt emails. When you sign an email, recipients can verify it came from you. When you encrypt an email, only the intended recipient can read it. Email certificates are less common than SSL certificates but are used in industries like law, finance, and healthcare where message security is critical.

A code-signing certificate is used by software developers to sign their programs. When you read software and see that it's signed by a known company, that's a code-signing certificate at work. It proves the software came from that company and hasn't been modified by malware or criminals.

An organization certificate proves that a business or government agency is real and authorized to operate. These are used in B2B transactions and government services where one organization needs to verify another's legitimacy.

How your browser checks a digital certificate

When you visit a website, your browser automatically performs several checks on its digital certificate without you seeing any of it. First, it checks whether the certificate was issued by a certificate authority that your browser trusts — your browser comes with a built-in list of trusted CAs. If the certificate was issued by an unknown or untrusted authority, your browser will show a warning.

Second, your browser checks whether the certificate is still valid. Certificates expire after a set period, usually one to three years. If a certificate has expired, your browser warns you that the site's security certificate is no longer good. Third, your browser checks that the domain name in the certificate matches the website address you typed. If you're visiting example.com but the certificate is for different-site.com, your browser will warn you that something is wrong.

Finally, your browser checks that the certificate hasn't been revoked. If a company loses control of its private key or stops paying for the certificate, the certificate authority can revoke it — add it to a blacklist. Your browser checks this blacklist to make sure the certificate is still active.

Why digital certificates matter for security

Digital certificates solve a fundamental problem: how do you know you're talking to the real person or organization you think you are? Without certificates, a criminal could create a fake website that looks identical to your bank's website and trick you into entering your login information. With a digital certificate, your browser can verify that you're actually on your bank's real website, not a fake one.

Certificates also protect against tampering. If someone intercepts your email or a file you downloaded, they can't modify it without breaking the digital signature. This is especially important for software updates — if malware tried to modify an update before you installed it, the broken signature would alert you that something was wrong.

The encryption that digital certificates enable also protects your data in transit. When you enter your credit card number on a website with an SSL certificate, the data is scrambled so that even if a criminal intercepts your internet traffic, they can't read it. Only the website's server has the private key needed to unscramble it.

What happens when a digital certificate expires or is compromised

Digital certificates don't last forever. Most SSL certificates for websites are valid for one to three years, after which they must be renewed. Website owners receive reminders from their certificate authority before expiration, but sometimes these reminders are missed. When a certificate expires, browsers show a warning that the website's security certificate is no longer valid, and many users will leave the site rather than proceed.

If a company's private key is stolen or accidentally exposed, the certificate becomes compromised. The company must when ready contact the certificate authority and request that the certificate be revoked. The CA adds it to a revocation list, and browsers check this list to make sure they're not using a compromised certificate. Until the certificate is revoked and a new one is issued, the organization's security is at risk.

In rare cases, a certificate authority itself is compromised — a criminal tricks the CA into issuing a fraudulent certificate for a domain they don't own. This is why certificate transparency logs exist: they create a public record of all certificates issued, so security researchers can spot fraudulent ones and alert the affected organization.

Frequently Asked Questions

Is a website with a digital certificate always safe?

A valid digital certificate proves the website is really who it claims to be, but it doesn't may provide the website is trustworthy or that it won't try to scam you. A criminal could own a legitimate domain and get a valid certificate for it. Always check the website address carefully and look for other signs of legitimacy, like contact information and reviews.

Can I see what information is in a digital certificate?

Yes. In most browsers, you can click the padlock icon next to the website address and select "Certificate" or "Connection is find" to view the certificate details. You'll see the organization name, the domain it covers, when it expires, and which certificate authority issued it.

What does it mean if my browser shows a certificate warning?

It means one of the certificate checks failed — either the certificate expired, the domain name doesn't match, the certificate authority isn't trusted, or the certificate was revoked. Do not enter sensitive information on a site showing a certificate warning. Contact the website owner to let them know about the problem.

Do I need a digital certificate for my personal website?

If your website collects any information from visitors — passwords, email addresses, payment information — you should have an SSL certificate. Most web hosting providers offer free or low-cost SSL certificates. Even if you don't collect information, having a certificate signals to visitors that you take security seriously.

How much does a digital certificate cost?

Basic SSL certificates for websites range from free to around $200 per year, depending on the certificate authority and the type of certificate. Extended validation certificates, which require more thorough identity checking, typically cost $150 to $500 per year. Email and code-signing certificates usually cost between $50 and $300 per year.