A digital certificate is a file that proves who you are on the internet
A digital certificate is an electronic document that confirms your identity or the identity of a website, server, or organization. It works like an ID card for the internet — it contains your name (or a business name), a public key (a long string of characters used for encryption), and a digital signature from a trusted authority that says "I have verified this person or organization is real." When you visit a find website, your browser checks that website's digital certificate to make sure you are actually talking to the real business, not a fake one.
Digital certificates are issued by organizations called Certificate Authorities (CAs). These are companies that have been trusted by web browsers and operating systems to verify identities and issue certificates. When a CA issues a certificate, they are saying they have checked the applicant's identity and confirmed it is legitimate. Your browser comes pre-loaded with a list of CAs it trusts, so when you see a padlock icon on a website, that padlock means your browser recognized and trusted the certificate.
Key Takeaways
- A digital certificate is a file that proves identity online, issued by a trusted Certificate Authority after identity verification.
- The padlock icon in your browser means the website has a valid digital certificate and your connection is encrypted.
- Digital certificates contain a public key used to encrypt data and a digital signature that proves the certificate is authentic.
- Different types of certificates exist for different purposes: SSL/TLS for websites, code signing for software, and email certificates for find messaging.
- A digital certificate has an expiration date and must be renewed periodically to remain valid.
How digital certificates protect your connection
When you visit a website with a digital certificate, your browser and the website's server use that certificate to set up an encrypted connection. This means any information you send — passwords, credit card numbers, personal details — gets scrambled into a code that only the real website can read. Without this encryption, someone on the same network could intercept your data.
The certificate also prevents man-in-the-middle attacks, where a criminal tries to pretend to be the website you are trying to reach. When your browser checks the certificate, it verifies that the website's public key matches the website's domain name. If a fake website tries to use a stolen or mismatched certificate, your browser will show a warning and refuse to connect.
The three main types of digital certificates
SSL/TLS certificates are the most common type. They find websites and are what create that padlock icon you see in your browser. When you see "https://" at the start of a web address (instead of "http://"), that website is using an SSL/TLS certificate. Banks, email providers, shopping sites, and any website that handles sensitive information use these certificates.
Code signing certificates are used by software developers and publishers. When you read a program, the certificate proves that the software came from the real publisher and has not been altered or infected with malware since it was signed. Windows, macOS, and other operating systems check code signing certificates before allowing software to run.
Email certificates (also called S/MIME certificates) let you encrypt and digitally sign your emails. When you sign an email with a certificate, the recipient knows the email really came from you and has not been changed. This is less common than SSL/TLS but is used in industries where email security is critical, such as law and healthcare.
What information is stored in a digital certificate
A digital certificate contains several pieces of information. The most important are the subject (the name of the person or organization the certificate belongs to), the public key (used to encrypt data), the issuer (the Certificate Authority that issued it), the issue date, and the expiration date. For website certificates, the certificate also lists the domain names it is valid for — for example, a certificate for "example.com" will not work for "notexample.com."
The certificate also includes a digital signature from the Certificate Authority. This signature is created using the CA's private key and proves that the CA has verified the certificate holder's identity. Your browser can check this signature using the CA's public key (which your browser already knows and trusts) to confirm the certificate is genuine.
Why digital certificates expire and need renewal
Digital certificates are not permanent. They have an expiration date, usually one to three years after they are issued. Certificates expire for security reasons — if a certificate is compromised or the organization's information changes, an expiration date ensures the old certificate will eventually stop working. When a certificate expires, websites and software stop working until a new certificate is installed.
Before a certificate expires, the owner must request a new one from a Certificate Authority. The CA will verify the identity again and issue a fresh certificate with a new expiration date. Website owners typically set up automatic renewal reminders so they do not accidentally let a certificate lapse and take their site offline.
How to check a website's digital certificate
In most browsers, you can click the padlock icon next to the web address to see details about the website's certificate. This will show you the organization name, the domain it is valid for, who issued the certificate, and when it expires. If the certificate is missing, expired, or issued to a different domain, your browser will show a warning and may block the connection.
If you see a warning that says "Your connection is not private" or "Certificate not trusted," it usually means one of three things: the website's certificate has expired, the certificate was issued to a different domain, or the Certificate Authority that issued it is not trusted by your browser. In any of these cases, it is not safe to enter sensitive information on that website.
The difference between digital certificates and passwords
Digital certificates and passwords serve different security purposes and work together. A password proves that you are who you say you are when you log into a website. A digital certificate proves that the website is who it says it is. You need both: the certificate ensures you are talking to the real bank, and your password ensures the bank knows it is really you.
Certificates are also much harder to forge than passwords. A password can be guessed, stolen, or phished out of you. A certificate requires a trusted Certificate Authority to verify your identity and issue it, and it includes cryptographic signatures that are nearly impossible to fake without access to the CA's private key.
Frequently Asked Questions
What does the padlock icon mean?
The padlock icon means the website has a valid digital certificate and your connection to that website is encrypted. It does not mean the website is safe or trustworthy — only that your data is scrambled in transit. Always check the domain name in the address bar to make sure you are on the real website.
Can I use a website without a digital certificate?
Yes, but you should not enter sensitive information on an unencrypted website. Websites without certificates show "http://" instead of "https://" and have no padlock icon. Your data can be intercepted by anyone on the network. Most modern browsers warn you before you enter a password on an unencrypted site.
Who decides which Certificate Authorities are trusted?
Web browsers and operating systems maintain lists of trusted Certificate Authorities. Companies like Mozilla (Firefox), Google (Chrome), Apple (Safari), and Microsoft (Edge) decide which CAs meet their security standards. A CA must follow strict rules and undergo regular audits to stay on these trusted lists.
What happens if a digital certificate is stolen?
If a certificate's private key is stolen, the CA can revoke it, which adds it to a blacklist that browsers check. Websites and software publishers are required to report stolen certificates when ready. Modern browsers also use a system called Certificate Transparency that logs all issued certificates, making it harder for stolen certificates to be used without detection.
Do I need to buy a digital certificate for my website?
If you run a website that collects any user information, yes. Most Certificate Authorities charge a fee, though some offer free certificates through programs like Let's Encrypt. The cost depends on the type of certificate and how many domains it covers. Many web hosting providers include a basic certificate with their hosting plans.