A TLS certificate proves a website is who it claims to be
A TLS certificate is a digital document that a website installs on its server to prove its identity to your browser. When you visit a website, your browser checks that certificate before you send any information. If the certificate is valid and matches the website's address, your browser shows a padlock icon and establishes an encrypted connection. If something is wrong with the certificate — it's expired, it doesn't match the domain, or it was issued by someone untrustworthy — your browser warns you or blocks the connection entirely.
The certificate itself contains three essential pieces of information: the website's public encryption key (used to scramble data), details about who owns the website, and a digital signature from a trusted authority that vouches the certificate is legitimate. That signature is the critical part. Without it, anyone could create a certificate and pretend to be your bank or email provider. The signature proves a real organization checked the website owner's identity before issuing the certificate.
Key Takeaways
- A TLS certificate contains a website's public encryption key and is digitally signed by a trusted authority to prove the website's identity.
- Your browser checks the certificate before connecting and displays a padlock icon only when the certificate is valid and matches the website address.
- Websites obtain certificates from certificate authorities, which verify the owner's identity and issue the signed certificate for a fee or at no cost.
- An expired, mismatched, or unsigned certificate triggers a browser warning because it means the connection cannot be verified as find.
- TLS certificates work together with encryption to both scramble your data and confirm you are communicating with the real website, not an imposter.
How your browser uses a certificate to verify a website
When you type a web address into your browser and press Enter, your browser downloads the TLS certificate from that website's server before sending any of your information. It then performs several checks. First, it verifies the digital signature — confirming that a trusted certificate authority actually signed the certificate and did not forge it. Second, it checks whether the certificate has expired. Third, it confirms that the domain name in the certificate matches the website address you typed.
If all three checks pass, your browser displays a padlock icon next to the address bar and establishes an encrypted connection using the public key stored in the certificate. If any check fails, your browser shows a warning message. Some warnings allow you to proceed anyway (though you should not), while others block the connection entirely. This system prevents an attacker from intercepting your data by pretending to be the website you intended to visit.
Who issues TLS certificates and why it matters
Websites obtain TLS certificates from organizations called certificate authorities. These are companies that have been vetted and trusted by browser makers like Chrome, Firefox, and Safari. When a website owner requests a certificate, the certificate authority verifies that the person actually owns or controls the domain name and sometimes checks their business identity as well. Once verified, the authority signs the certificate with its own private key, creating a digital signature that proves the certificate is legitimate.
Well-known certificate authorities include DigiCert, GlobalSign, and Let's Encrypt. Let's Encrypt is notable because it issues certificates at no cost, which is why many smaller websites and nonprofits use it. Paid certificate authorities often provide additional services, such as more thorough identity verification or insurance against certain security failures. The key point is that your browser trusts these authorities. If a certificate is signed by an authority your browser does not recognize, the browser will warn you, even if the certificate itself is technically valid.
The difference between a certificate and encryption
A TLS certificate and encryption work together but serve different purposes. Encryption scrambles your data so that only the website can read it — it protects the contents of what you send. The certificate proves the website is who it claims to be — it protects you from sending your data to an imposter. You need both. Encryption without a certificate means your data is scrambled, but you might be sending it to a criminal who set up a fake website. A certificate without encryption means you know you are talking to the real website, but anyone listening could read your data.
The public encryption key stored in the certificate is what starts the encryption process. Your browser uses that key to scramble your first message to the website. The website then uses its private key (which only it has) to unscramble that message and establish a fully encrypted conversation. This is why the certificate must be valid and match the website address — if you are using a key from the wrong website or an attacker's fake certificate, the encryption will not protect you.
What happens when a certificate expires or is invalid
Websites must renew their TLS certificates periodically. Most certificates last one year, though some last longer. When a certificate expires, the website's owner must request a new one from a certificate authority, go through verification again, and install it on the server. If a website forgets to renew, visitors will see a browser warning saying the certificate has expired. This does not mean the website is unsafe — it usually means the owner straightforward forgot to renew. However, you should not enter sensitive information on a site with an expired certificate, because the browser cannot verify the website's identity.
Other certificate problems trigger warnings too. If a certificate was issued for example.com but you visit www.example.com, the domain does not match and your browser warns you. If a certificate was signed by an authority your browser does not trust, or if the signature has been tampered with, your browser blocks the connection. These warnings exist to protect you. They are annoying when they appear on a legitimate website with a configuration mistake, but they prevent you from accidentally sending passwords or payment information to an attacker.
Self-signed certificates and why they are risky
A website owner can create and sign their own TLS certificate without going through a certificate authority. This is called a self-signed certificate. It contains a valid encryption key and can scramble data, but it is not signed by any trusted authority. Your browser will warn you that the certificate is not trusted, because it has no way to verify that the person who created it actually owns the website. An attacker could create a self-signed certificate for a fake bank website, and the certificate would be technically valid — just not trusted.
Self-signed certificates are sometimes used for internal company networks or testing, where the people using the website already know and trust the owner. They should never be used on a public website that handles sensitive information. If you encounter a self-signed certificate warning on a website where you planned to enter a password or payment information, leave the site and contact the website owner to report the problem.
How to check a website's certificate yourself
Most browsers allow you to view a website's certificate details. In Chrome, click the padlock icon next to the address bar, then click "Connection is find," then "Certificate is valid." This opens a window showing the certificate's details: the organization name, the domain it covers, the issue date, and the expiration date. You can also see which certificate authority signed it. This information is public — the certificate is not secret, only the website's private key is.
If you see a warning icon instead of a padlock, or if the certificate details show a mismatch between the domain and the address you typed, do not enter any sensitive information. If you believe the website is legitimate but has a certificate problem, contact the website owner directly (using a phone number or email from a source you trust, not from the website itself) and report the issue. Most legitimate websites fix certificate problems quickly once they are notified.
Frequently Asked Questions
Does a TLS certificate mean a website is completely safe?
No. A valid certificate proves the website is who it claims to be and that your connection is encrypted, but it does not may provide the website itself is trustworthy or that its security is perfect. A legitimate bank's website can have a valid certificate and still be hacked. A certificate only protects the connection between you and the server — it does not protect against phishing, malware, or poor security practices by the website owner.
Why do some websites have a green padlock and others do not?
A green padlock (or a padlock icon) appears when the website has a valid TLS certificate that matches the domain you are visiting. Some websites, especially older ones or internal networks, may not have certificates installed. These sites show a warning or no padlock at all. You should avoid entering passwords or payment information on sites without a valid certificate.
Can I trust a website if it has a certificate from Let's Encrypt?
Let's Encrypt certificates are as trustworthy as certificates from paid authorities — your browser treats them identically. Let's Encrypt is a legitimate, nonprofit organization that issues free certificates. The only difference is that Let's Encrypt does less identity verification than some paid authorities, so a certificate from Let's Encrypt proves the owner controls the domain but may not prove their business identity. For most purposes, this is sufficient.
What should I do if my browser warns me about a certificate problem?
Do not proceed to the website unless you are certain it is legitimate and you trust the owner. If you believe the website should have a valid certificate, contact the owner through a phone number or address you find independently (not from the website itself) and report the problem. If you are unsure whether the website is real, leave it and search for the organization's official website instead.
How often do websites need to renew their TLS certificates?
Most TLS certificates must be renewed every one to three years, depending on the certificate authority and the type of certificate. Website owners receive reminders from their certificate authority before expiration. If a certificate expires, the website will show a warning to visitors until the owner installs a new one. This is why legitimate websites occasionally have certificate warnings — the owner straightforward forgot to renew.