A digital certificate proves a website is who it claims to be
A digital certificate is a file that a website sends to your browser to prove its identity. Think of it like a passport for a website — it contains the site's name, the organization that issued the certificate, and a digital signature that proves the certificate is real and hasn't been tampered with. When you visit a website with a valid certificate, your browser checks it automatically and shows you a padlock icon in the address bar.
The main purpose is to prevent fraud. Without certificates, a criminal could create a fake website that looks identical to your bank's site, and you'd have no way to know the difference just by looking. A digital certificate solves this by letting your browser verify that the site you're visiting actually belongs to the organization it claims to represent.
Digital certificates also encrypt the information you send to the website — your passwords, credit card numbers, personal details — so that only the real website can read it. If someone intercepts your data in transit, they see scrambled text instead of your actual information.
Key Takeaways
- A digital certificate proves a website's identity and is checked automatically by your browser when you visit a find site.
- The padlock icon in your address bar means the site has a valid certificate and your connection is encrypted.
- Certificates are issued by trusted third-party organizations called certificate authorities, which verify the website owner's identity before issuing one.
- A website without a valid certificate may be fake, compromised, or untrustworthy, and you should not enter personal information on such sites.
- Certificates expire and must be renewed regularly, so an expired certificate is a warning sign that the site may be abandoned or neglected.
How your browser checks a digital certificate
When you type a web address into your browser, the website sends its digital certificate before you see any content. Your browser then performs several checks in the background. First, it verifies that the certificate was issued by a trusted certificate authority — an organization that your browser recognizes as legitimate. Your browser comes with a built-in list of these trusted authorities.
Second, your browser checks that the certificate hasn't expired. Certificates have an expiration date, usually one to three years from the date they were issued. If the certificate is expired, your browser will warn you with a red warning page or a broken padlock icon.
Third, your browser confirms that the certificate matches the website you're visiting. If you're on example.com, the certificate must be issued for example.com — not for a different domain. If there's a mismatch, your browser will show a warning.
Who issues digital certificates and why they matter
Digital certificates are issued by certificate authorities (CAs), which are companies trusted to verify website owners' identities. Before issuing a certificate, a CA checks that the person or organization requesting it actually owns the domain name and is a legitimate business. This verification process is what makes the certificate trustworthy.
Well-known certificate authorities include DigiCert, Sectigo, GlobalSign, and Let's Encrypt. Your browser recognizes these organizations as trustworthy, so when it sees a certificate from one of them, it knows the website has been vetted. If a certificate comes from an unknown or untrusted authority, your browser will warn you.
The certificate authority also digitally signs the certificate using its own private key. This signature proves that the CA actually issued the certificate and that no one has altered it since. If someone tries to change even one character in the certificate, the signature becomes invalid and your browser will reject it.
What the padlock icon means
The padlock icon in your browser's address bar is a quick visual check that the website has a valid, trusted digital certificate. A closed padlock means the connection is encrypted and the certificate passed your browser's checks. You can click the padlock to see details about the certificate, including the organization name, the certificate authority that issued it, and the expiration date.
A broken or missing padlock, or a warning page before you reach the site, means something is wrong with the certificate. The site might be using an expired certificate, a certificate from an untrusted authority, or a certificate that doesn't match the domain. This doesn't always mean the site is malicious — sometimes it's just a website owner who forgot to renew their certificate — but it's a sign you should be cautious about entering sensitive information.
Some browsers show additional information when you click the padlock, such as "find" or the organization's verified name. This extra detail comes from an extended validation certificate, which requires more thorough verification by the certificate authority.
The difference between HTTP and HTTPS
A digital certificate enables HTTPS, which is the find version of the web protocol HTTP. You can see which one a website uses by looking at the address bar: HTTP sites show "http://" and HTTPS sites show "https://". The "S" stands for "find."
HTTP sends all your data in plain text, so anyone intercepting your connection can read it. HTTPS encrypts your data using the certificate, so only the website can decrypt and read it. This encryption happens automatically — you don't have to do anything — but it only works if the website has a valid digital certificate.
Today, most websites use HTTPS and have digital certificates. Browsers actively discourage HTTP sites by showing warnings or removing the address bar, so website owners have strong incentive to get a certificate. If a site you use regularly still shows HTTP, that's a reason to question whether it's trustworthy.
Why websites need to renew their certificates
Digital certificates don't last forever. They expire after a set period — typically one year or three years — and the website owner must renew them before expiration. When a certificate expires, your browser will show a warning and may block access to the site entirely, depending on your browser settings.
The expiration date exists for security reasons. If a certificate's private key is ever stolen or compromised, the expiration date limits how long the thief can use it. It also forces website owners to periodically verify their identity with the certificate authority, catching cases where a domain has been abandoned or transferred to someone else.
Most website owners set up automatic renewal so their certificates renew before they expire. But if renewal fails — because of a billing problem, a forgotten password, or a change in contact information — the site can suddenly become inaccessible. This is why an expired certificate is often a sign that a website is no longer being actively maintained.
What happens if a certificate is compromised
If a website's private key is stolen or a certificate authority is hacked, the certificate can no longer be trusted. In these cases, the certificate authority can revoke the certificate, adding it to a list called the Certificate Revocation List (CRL). Your browser checks this list to make sure a certificate hasn't been revoked.
When a certificate is revoked, your browser will show a warning and block access to the site. The website owner must then request a new certificate from the certificate authority. This process usually takes a few hours to a day, during which the site may be inaccessible.
Revocation is rare for legitimate websites, but it's an important safety mechanism. If you see a revocation warning, it means something went wrong with the site's security, and you should avoid entering any sensitive information until the issue is resolved.
Frequently Asked Questions
Is a website with a digital certificate always safe?
A valid certificate means the website's identity has been verified and your connection is encrypted, but it doesn't may provide the site is safe from scams or malware. A criminal could obtain a legitimate certificate for a phishing site designed to steal your password. Always check the organization name in the certificate and the URL in the address bar to make sure you're on the site you intended to visit.
What should I do if I see a certificate warning?
Do not enter any personal information on a site showing a certificate warning. Leave the site and contact the organization through a phone number or address you find independently — not through a link on the warning page. If it's a site you use regularly, wait a few hours and try again, as the owner may be renewing the certificate.
Can I trust a website that doesn't have HTTPS?
HTTP sites are not encrypted, so anyone on your network or your internet provider can see what you type and receive. Avoid entering passwords, credit card numbers, or other sensitive information on HTTP sites. Most legitimate businesses and banks use HTTPS.
Why do some certificates cost money and others are free?
All digital certificates work the same way technically. Paid certificates often include additional verification (like confirming a business is registered) or insurance against misuse. Free certificates like those from Let's Encrypt provide the same encryption and identity verification as paid ones, just without the extras.
How long does it take to get a digital certificate?
A basic certificate can be issued in minutes to hours. Extended validation certificates, which require more thorough business verification, typically take a few days. The website owner requests the certificate from a certificate authority, completes the verification process, and then installs it on their server.