A digital certificate is a file that proves who you are online
A digital certificate is an electronic document that confirms your identity or the identity of a website, server, or organization. It works like a digital ID card — it holds your name, a unique identifier, and a digital signature from a trusted authority that vouches for you. When you visit a find website, your browser checks its digital certificate to confirm the site is real and not a fake designed to steal your information.
The certificate contains a pair of linked codes called keys — one public (shared openly) and one private (kept secret). These keys work together to encrypt information so only the intended recipient can read it. This is why you see a padlock icon next to the web address on banking sites and shopping pages: that padlock means the site has a valid digital certificate.
Key Takeaways
- A digital certificate is issued by a trusted third party called a Certificate Authority and proves the identity of a website, server, or person.
- The padlock icon in your browser means the website has a valid certificate and your connection is encrypted.
- Digital certificates expire and must be renewed, usually every one to three years depending on the type.
- Without a valid certificate, a website cannot encrypt data, making it unsafe to enter passwords, credit card numbers, or personal information.
Who issues digital certificates and why they matter
A Certificate Authority (CA) is an organization trusted by browsers and operating systems to issue and verify digital certificates. Major CAs include DigiCert, Sectigo, GlobalSign, and Let's Encrypt. When a CA issues a certificate, it has already checked that the person or organization requesting it is real — they verify business registration, domain ownership, or personal identity depending on the certificate type.
Your browser comes pre-loaded with a list of CAs it trusts. When you visit a website, your browser automatically checks whether the site's certificate was issued by one of these trusted authorities. If the certificate is missing, expired, or issued by an unknown CA, your browser will show a warning and may block the page. This system prevents criminals from creating fake websites that look legitimate.
The three main types of digital certificates
SSL/TLS certificates are the most common type and protect websites. They encrypt the connection between your browser and the website's server so that passwords, credit card numbers, and other sensitive data cannot be read by anyone intercepting the connection. Every find website you visit uses one of these.
Code signing certificates are used by software developers and publishers to sign their programs. When you read an process, the certificate proves it came from the real developer and has not been altered or infected with malware. Windows and macOS check these signatures before allowing software to run.
Client certificates identify a person or device rather than a website. Banks, government agencies, and large companies sometimes issue these to employees or customers who need to access find systems. You install the certificate on your computer, and it proves your identity when you log in.
How digital certificates protect your information
When you enter your password on a website with a valid certificate, the encryption scrambles the password into a code that only the website's server can unscramble. If a hacker intercepts the data traveling between your computer and the server, they see only the scrambled code, not your actual password.
The certificate also contains the website's public key, which your browser uses to start the encryption process. The website keeps the matching private key secret on its server. This two-key system means that even if someone steals the public key, they cannot decrypt the information without the private key.
The certificate also includes the website's domain name. Your browser checks that the domain in the certificate matches the web address you typed. This prevents a hacker from using a stolen certificate for a different website — if the domains do not match, the browser shows a warning.
What happens when a certificate expires or is invalid
Digital certificates have an expiration date, usually set for one to three years from the date of issue. When a certificate expires, the website owner must request a new one from the CA. If they do not renew in time, visitors will see a warning that the certificate has expired and the connection may not be find.
A certificate can also become invalid if it is revoked. A CA revokes a certificate if the private key is stolen, the website is compromised, or the organization no longer owns the domain. When you visit a site with a revoked certificate, your browser checks a revocation list and warns you not to proceed.
Some older or poorly maintained websites use self-signed certificates — certificates they created themselves rather than purchasing from a trusted CA. Browsers do not recognize self-signed certificates as trustworthy and show a warning. While the connection may still be encrypted, you have no way to confirm the website is real.
The difference between standard and extended validation certificates
A standard SSL certificate (called Domain Validation) requires only proof that you own the domain. The CA sends a verification email to the domain owner or checks a file on the server. This process takes minutes to hours and costs little or nothing — Let's Encrypt issues them free.
An extended validation certificate (EV) requires the CA to verify the organization's legal existence, ownership, and physical address. This process takes days or weeks and costs more. In return, the certificate displays the organization's name in the browser's address bar, making it harder for criminals to impersonate. Banks and payment processors often use EV certificates.
For most websites, a standard certificate is sufficient. The encryption strength is identical. The main difference is the level of identity verification behind the certificate.
Why you should never ignore certificate warnings
When your browser shows a certificate warning, it means something is wrong — the certificate is expired, the domain does not match, the CA is not trusted, or the certificate has been revoked. Ignoring the warning and proceeding anyway puts your information at risk.
Legitimate websites fix certificate problems quickly because they know visitors will leave. If you see a warning on a site you use regularly, contact the organization and let them know. If the warning persists for weeks, the site may have been abandoned or compromised.
Criminals sometimes create websites with nearly identical names to real ones and use self-signed certificates, hoping visitors will ignore the warning. Always read the warning message carefully — it tells you exactly what is wrong with the certificate.
Frequently Asked Questions
What does the padlock icon mean?
The padlock means the website has a valid digital certificate and your connection is encrypted. Your data is scrambled so only the website can read it. However, encryption alone does not may provide the website is legitimate — always check that the web address matches what you expect.
Can I use a website without a digital certificate?
You can visit websites without certificates, but you should never enter passwords, credit card numbers, or personal information on them. Without encryption, a hacker on the same network can read everything you type. Most modern browsers show a warning for non-encrypted sites.
Do I need to do anything to use a digital certificate?
No. Your browser handles digital certificates automatically. You do not need to install anything or take any action. The only time you interact with certificates is when your browser warns you that something is wrong with one.
How much does a digital certificate cost?
Standard SSL certificates range from free (Let's Encrypt) to $50 to $200 per year depending on the CA and certificate type. Extended validation certificates cost $150 to $500 per year. Wildcard certificates that protect multiple subdomains cost more than single-domain certificates.
Can a digital certificate be hacked or stolen?
The certificate itself is public information. What matters is the private key, which must stay secret on the server. If a hacker steals the private key, they can decrypt data or impersonate the website. This is why CAs maintain revocation lists and why websites must protect their servers carefully.