SSL/TLS glossary
Short, plain-English definitions of the terms behind certificate outages. Every entry names its source and links the check that shows you the real thing on your own domain.
- SSL certificate chainWhat an SSL certificate chain is, why servers must send the intermediates, and how a chain that is valid on disk still breaks visitors on the wire.
- intermediate certificateWhat an intermediate certificate does, why CAs sign with intermediates instead of roots, and how a stale or expired intermediate takes down valid sites.
- root certificateWhat a root certificate is, how root trust stores decide which CAs browsers believe, and what actually happens when a widely used root expires.
- SAN certificateWhat a SAN certificate is, how subject alternative names decide which hostnames a certificate covers, and why the Common Name field no longer counts.
- wildcard certificateWhat a wildcard certificate covers and what it does not, why issuance requires DNS validation, and the blast radius trade-off of sharing one key.
- OCSP staplingWhat OCSP stapling does, the privacy and latency problems it solved, and why the web is moving from OCSP toward CRL-based revocation instead.
- Certificate TransparencyHow Certificate Transparency logs every public certificate, why browsers require proof of logging, and what CT search reveals about your own domains.
- certificate revocationWhat revoking a certificate actually does, why browsers ignore much of it, and how CRL summaries and short lifetimes replaced live OCSP checks.
- CRL distribution pointWhat the CRL distribution point extension is, how clients use it to find revocation lists, and why CRLs are back at the centre of web PKI revocation.
- Let's Encrypt rate limitsThe Let's Encrypt rate limits that actually interrupt issuance, how renewals are exempted, and how to wait out or design around each limit.
- self-signed certificateWhat a self-signed certificate is, why browsers reject it by design, and where self-signed and private-CA certificates genuinely belong.
- certificate authorityWhat a certificate authority does, who holds CAs accountable, and how validation, audits, and shrinking lifetimes shape the certificates you run.
- TLS handshakeWhat the TLS handshake negotiates, where the certificate check happens, and how handshake failures differ from certificate errors when debugging.
- DV, OV, and EV certificatesWhat DV, OV, and EV validation levels actually verify, what browsers still show for each, and which differences matter when buying certificates.
- HSTSWhat the HSTS header does, how max-age and preload remove the insecure first request, and why HSTS turns certificate mistakes into hard outages.
- SSL certificateAn SSL certificate is the file that lets a site prove its identity and encrypt traffic. What it contains, who issues it, and why "SSL" is really TLS now.
- TLS certificateA TLS certificate is the same file people call an SSL certificate. Why the name changed from SSL to TLS, and what actually differs (nothing, in the file).
- cipher suiteA cipher suite is the named set of algorithms a TLS connection uses for key exchange, encryption, and integrity. How they are chosen and why weak ones fail.
- Let's EncryptLet's Encrypt is a free, automated certificate authority run by the nonprofit ISRG. How it issues certificates, the 90-day lifetime, and what to watch.
- SectigoSectigo is a commercial certificate authority, formerly Comodo CA. What it issues, how it differs from a free CA, and why the old Comodo name still appears.
- DigiCertDigiCert is a large commercial certificate authority, now running the former Symantec CA roots. What it issues and when a commercial CA is the right choice.