A TLS certificate (commonly called an “SSL certificate”) is a digital document that binds a domain name to a cryptographic public key, signed by a trusted Certificate Authority. When a browser connects to your server over HTTPS, the server presents this certificate. The browser verifies the signature chain, confirms the domain matches, checks it’s not expired — and only then establishes the encrypted connection.
No valid certificate = no HTTPS = no trust. Browsers show “Not Secure” warnings, search engines penalize rankings, and users leave.
How TLS Certificates Work
1. Browser connects to https://example.com
2. Server presents its TLS certificate
3. Browser checks:
├── Is the certificate expired? (notBefore/notAfter)
├── Does the domain match? (SAN extension)
├── Is the chain valid? (signature → intermediate → root in trust store)
├── Is it revoked? (OCSP/CRL check)
└── All pass? → Encrypted connection established
4. ECDHE key exchange → symmetric session keys derived
5. All data encrypted with AES-256-GCMTypes of TLS Certificates
By Validation Level
| Type | What’s Verified | Issuance Time | Cost | Use Case |
|---|---|---|---|---|
| DV (Domain Validated) | Domain ownership only | Seconds (ACME) | Free-$50/yr | Most websites, APIs |
| OV (Organization Validated) | Domain + organization identity | 1-3 days | $50-200/yr | Business websites |
| EV (Extended Validation) | Domain + org + legal verification | 3-7 days | $200-1000/yr | Financial services (diminishing value) |
Practical advice: Use DV for everything unless compliance specifically requires OV/EV. The encryption strength is identical across all three — the difference is only what identity information appears in the certificate details.
By Scope
| Type | Covers | Example | Best For |
|---|---|---|---|
| Single-domain | One exact FQDN | www.example.com | Simple sites |
| Wildcard | All single-level subdomains | *.example.com | Multi-subdomain sites |
| Multi-domain (SAN) | Multiple specific domains | example.com + example.org + api.example.com | Multiple properties |
How to Get a TLS Certificate
Free (Let’s Encrypt via ACME)
# Certbot — most common ACME client
certbot certonly --nginx -d example.com -d www.example.com
# Certificate issued in ~10 seconds
# Auto-renews every 60 days via systemd timer
# Valid for 90 daysFree (Cloudflare / Cloud Provider)
# Cloudflare: automatic certificate for any domain using their DNS/CDN
# AWS ACM: free certificates for use with ALB/CloudFront
# GCP: managed certificates for Cloud Load Balancing
# No manual management — provider handles everythingPaid (DigiCert, Sectigo, etc.)
# For OV/EV certificates or specific compliance requirements
# Submit CSR → CA verifies organization → certificate issued (1-7 days)
# Valid for up to 398 days (CA/Browser Forum maximum)Certificate Anatomy (X.509)
# View certificate details
openssl x509 -in cert.pem -noout -text
# Key fields:
Subject: CN=api.example.com # Who this cert identifies
Issuer: CN=R3, O=Let's Encrypt # Who signed it
Validity:
Not Before: Mar 1 00:00:00 2026 GMT # Start of validity
Not After: May 30 23:59:59 2026 GMT # Expiry date
Public Key Algorithm: id-ecPublicKey (P-256) # Key type
X509v3 Subject Alternative Name: # All covered domains
DNS:api.example.com, DNS:www.example.com
X509v3 Key Usage: Digital Signature # What the key can do
X509v3 Extended Key Usage: TLS Web Server Auth # PurposeCertificate Management at Scale
The Problem
A mid-size enterprise has 3,000-10,000 certificates:
- Different CAs (Let’s Encrypt, DigiCert, internal CA)
- Different validity periods (90 days to 1 year)
- Different deployment targets (Nginx, K8s, ALB, F5, IIS)
- Different teams managing them (nobody has the full picture)
The Solution
| Scale | Approach |
|---|---|
| 1-10 certs | Certbot + calendar reminders |
| 10-100 certs | cert-manager + Prometheus monitoring |
| 100-1000 certs | CLM platform (centralized discovery + automation) |
| 1000+ certs | Enterprise CLM with multi-CA, multi-target, policy enforcement |
Common Certificate Problems
Expired Certificate
Symptom: NET::ERR_CERT_DATE_INVALID in browser
Cause: Nobody renewed it before notAfter date
Fix: Renew immediately. Then: set up automated renewal + monitoring.
Incomplete Chain
Symptom: Works in Chrome, fails in curl/Java/mobile
Cause: Server sends leaf cert but not intermediate
Fix: Configure full chain: cat server.crt intermediate.crt > fullchain.pem
Hostname Mismatch
Symptom: NET::ERR_CERT_COMMON_NAME_INVALID
Cause: Certificate SANs don’t include the domain being accessed
Fix: Request new certificate with correct SANs
Mixed Content
Symptom: Padlock disappears, “mixed content” console warnings
Cause: HTTPS page loads resources over HTTP
Fix: Change all resource URLs to HTTPS (or use protocol-relative //)
The 47-Day Future
The CA/Browser Forum voted to reduce maximum certificate validity to 47 days by 2029. This means:
- Every certificate needs renewal every 6 weeks
- Manual management becomes impossible
- Automation (ACME, cert-manager, CLM platforms) becomes mandatory
Read our complete guide on preparing for 47-day certificates →
FAQ
Q: Is “SSL certificate” the same as “TLS certificate”? A: Yes — same thing. “SSL” is the old name that stuck. The actual protocol is TLS (SSL has been dead since 2015). Read more about SSL vs TLS →
Q: Do I need a certificate for internal services? A: Yes — if they handle sensitive data or you’re implementing zero trust. Use a private CA (Vault, cert-manager self-signed issuer) for internal services. They don’t need to be publicly trusted.
Q: How much does a TLS certificate cost? A: DV certificates: free (Let’s Encrypt). OV: $50-200/year. EV: $200-1000/year. For most use cases, free DV certificates from Let’s Encrypt are sufficient.
Q: What key type should I use? A: ECDSA P-256 for new certificates (smaller, faster than RSA). RSA-2048 only for legacy compatibility. Read RSA vs ECC comparison →
Q: How do I monitor certificate expiry? A: Prometheus + blackbox_exporter (free, probes actual endpoints). Or a CLM platform for enterprise-scale monitoring with ownership mapping and escalation.
Managing hundreds of certificates across multiple environments? QCecuring Certificate Lifecycle Management provides centralized discovery, automated renewal, and compliance reporting for your entire certificate estate. Request a demo →