What is an SSL certificate?

An SSL certificate is a small signed file a website presents so a browser can do two things: confirm the site is who it claims to be, and set up an encrypted connection. The name is a holdover. The protocol that actually secures the connection has been TLS for years, but the certificates are still universally called SSL certificates, and the two names point at the same file.

Inside the certificate are a few things that matter. There is the list of hostnames it covers, in the Subject Alternative Name field, which decides whether it matches the site you visited. There is a validity window, a notBefore and a notAfter date, outside of which browsers refuse it. There is the public key that the encryption is built on. And there is a signature from a certificate authority, which is what lets a browser trust the certificate without having ever seen your site before.

The trust is the part people underrate. Encryption alone is easy; anyone can generate a key. What an SSL certificate adds is a chain of signatures leading to a root the browser already carries, so the browser can believe the certificate belongs to the domain in front of it. A certificate that encrypts but cannot prove identity, such as a self-signed one, still triggers a full-page warning.

For an operator, the SSL certificate is a thing with a short life that has to be renewed and reloaded on schedule, served with its full chain, and kept in sync with every hostname the site answers on. Most outages blamed on "SSL" are one of those three going wrong — an expiry, a broken chain, or a missing hostname — not the cryptography itself.