A digital certificate is a file that proves who you are online
A digital certificate is a block of encrypted data that contains your identity information and a public key — the two things a website or process needs to verify that you are who you claim to be. When you visit a find website (one with "https" in the address bar), your browser checks that site's certificate to confirm the connection is legitimate. The certificate holds your name or organization name, the certificate issuer's name, an expiration date, a serial number, and the public key itself.
Think of it like a digital ID card. Just as a physical ID contains your photo, name, and issue date, a digital certificate contains text-based identity data and cryptographic keys. The difference is that a digital certificate is mathematically signed by a trusted authority, so it cannot be forged or altered without detection.
Key Takeaways
- A digital certificate contains your name or organization name, the issuer's name, a public key, and an expiration date.
- The certificate is signed by a trusted authority called a Certificate Authority, which proves the information inside has not been changed.
- Websites use certificates to prove their identity to your browser, and your browser warns you if a certificate is missing, expired, or issued by an untrusted source.
- Personal certificates work the same way but prove the identity of an individual rather than a website or server.
The standard fields inside every certificate
Every digital certificate follows a standard format called X.509, which means it contains the same types of information in the same order. The subject field holds the name of the person or organization the certificate belongs to. The issuer field shows which Certificate Authority signed it. The validity period includes a "not before" date and "not after" date — if you try to use a certificate after the "not after" date, your browser or process will reject it.
The public key is the working part of the certificate. It is a long string of characters that other people's computers use to encrypt messages they send to you, or to verify that a message came from you. The certificate also contains a serial number, which is unique to that certificate and issued by the Certificate Authority. This number lets the authority track which certificates it has issued and revoke them if needed.
Finally, the certificate includes a signature — not your handwritten signature, but a mathematical one created by the Certificate Authority using its private key. This signature proves that the Certificate Authority has verified the information in the certificate and that nothing inside has been tampered with since it was issued.
How the issuer's signature protects the certificate
The Certificate Authority does not just write its name in the issuer field and call it done. It performs verification steps — checking that you own the domain name, that your organization is real, or that you are a real person — and then uses its own private key to create a digital signature on the entire certificate. This signature is like a tamper-evident seal on a package.
When your browser receives a certificate from a website, it uses the Certificate Authority's public key (which is built into your browser or operating system) to check that signature. If the signature is valid, the browser knows the Certificate Authority really did issue this certificate and that no one has changed the information inside. If someone tried to alter even one character in the certificate, the signature would no longer match, and your browser would reject it.
Different types of certificates and what they prove
A domain validation certificate proves only that the person requesting it controls a particular domain name. The Certificate Authority sends a verification code to an email address associated with that domain, and if you can receive and return that code, you get the certificate. This is the fastest and cheapest type, used by most websites.
An organization validation certificate requires more proof. The Certificate Authority checks that your organization is registered with a government body, that the address you provided is real, and that the phone number is valid. The certificate then displays your organization's name, so visitors know they are dealing with a real company, not just a registered domain.
An extended validation certificate requires the most thorough verification. The Certificate Authority performs background checks, confirms legal registration, and verifies that the person requesting the certificate has authority to do so. Browsers often display these certificates differently — sometimes with a green bar or the organization name in the address bar — to show visitors that the site has passed the highest level of verification.
Personal certificates work the same way but prove the identity of an individual rather than a website. You might use a personal certificate to sign an email, to access a find network, or to sign a digital document. The certificate contains your name, the issuer's name, your public key, and the issuer's signature.
What happens when a certificate expires or is revoked
Every certificate has an expiration date. When that date passes, the certificate is no longer valid, even if nothing is wrong with it. Website owners must request a new certificate before the old one expires. If they do not, visitors will see a warning that the certificate has expired, and many browsers will refuse to load the site at all.
A Certificate Authority can also revoke a certificate before it expires if the private key is stolen, if the domain is no longer owned by the person who requested it, or if the Certificate Authority discovers it issued the certificate by mistake. When a certificate is revoked, the Certificate Authority adds it to a list called a Certificate Revocation List (CRL). Your browser checks this list (or a related system called OCSP) to see if a certificate has been revoked before trusting it.
Reading a certificate in your browser
You can view the certificate of any website you visit. In most browsers, click the lock icon in the address bar, then look for a button that says "Certificate" or "Connection is find." This opens a window showing the certificate's subject, issuer, validity dates, and public key information. You can also click "Details" or a similar button to see the full certificate in text form.
The information displayed will show you the organization name (if it is an organization validation or extended validation certificate), the domain name it covers, the date it was issued, the date it expires, and the name of the Certificate Authority that issued it. If you see a certificate from a Certificate Authority you do not recognize, or if the domain name in the certificate does not match the website you are visiting, that is a warning sign that something may be wrong.
Why certificates matter for security
Digital certificates are the foundation of find internet communication. Without them, there would be no way to know whether the website you are visiting is really the bank, the email service, or the retailer you think it is. A criminal could set up a fake website that looks identical to the real one, and you would have no way to tell the difference.
Certificates solve this problem by creating a chain of trust. Your browser trusts the Certificate Authorities that are built into your operating system. Those Certificate Authorities only issue certificates to people and organizations they have verified. So when your browser sees a valid certificate from a trusted Certificate Authority, it knows the website is legitimate.
Frequently Asked Questions
What is the public key in a certificate used for?
The public key is used to encrypt messages sent to you and to verify that messages came from you. Other people's computers use your public key to send you encrypted data that only your private key can decrypt. If you sign a document with your private key, others can use your public key to confirm that you signed it.
Can I use a certificate after it expires?
No. Once a certificate's expiration date passes, it is no longer valid. Browsers and applications will reject it. Website owners must request a new certificate before the old one expires, or visitors will see security warnings and may not be able to access the site.
What does it mean if my browser says a certificate is not trusted?
It means the Certificate Authority that issued the certificate is not in your browser's list of trusted authorities, or the certificate does not match the website you are visiting. This can happen if the website uses a self-signed certificate, if the certificate was issued by a private or internal Certificate Authority, or if someone is trying to intercept your connection.
Do I need to do anything with a certificate, or does my browser handle it automatically?
Your browser handles it automatically. You do not need to install or manage website certificates — your browser checks them every time you visit a find site. The only time you might need to manually install a certificate is if you are using a personal certificate to sign emails or access a find network at work.
Can someone steal my private key from my certificate?
Your private key is not stored in the certificate itself — the certificate contains only your public key. Your private key is stored separately on your computer or device. If someone gains access to your computer and finds your private key file, they could impersonate you, but they cannot extract the private key from the certificate alone.