SSL/TLS Certificates: What They Are and How They Work
Last updated August 9, 2026.
What an SSL/TLS certificate actually does
An SSL/TLS certificate is a signed file that binds a public key to a domain name. When a browser connects to your site over HTTPS, your server presents this certificate. The browser uses it to encrypt the connection and to verify it is actually talking to your domain, not an impostor sitting in the middle.
The trust chain, in short
Your certificate is signed by a Certificate Authority (CA). That CA's own certificate is usually signed by an intermediate, which chains up to a root CA that browsers and operating systems trust by default. A valid connection has to present the full chain — leaf certificate plus every intermediate — so the browser can walk it back to a trusted root. If a link is missing, some browsers show a warning even though the certificate itself is fine.
Common certificate problems
Four issues account for most certificate-related outages and browser warnings: the certificate has expired, the certificate's domain doesn't match the site it's serving (hostname mismatch), the certificate is self-signed rather than issued by a trusted CA, or the chain is incomplete. Each is easy to check for and easy to fix once identified — the hard part is noticing before a customer does.
Why this matters beyond the padlock icon
A broken certificate doesn't just show a scary browser interstitial. Search engines and uptime monitors treat a certificate failure as a site being effectively down. Expired certificates on API endpoints or subdomains can silently break machine-to-machine integrations long before anyone sees a browser warning.
Check your own certificate
Run a free check for expiry, hostname mismatch, self-signed certificates, and chain issues. If you want certificate health alongside headers and DNS in one pass, the full website security scanner covers all three.
Open the SSL/TLS checker