# TLS certificate

> The ID card a website shows your browser to prove it is who it claims to be.

- Level: Intermediate
- Topics: Security, Networks
- URL: https://tidbit.legios.com.ar/tls-certificate/
- In Spanish: [Certificado TLS](https://tidbit.legios.com.ar/es/tls-certificate/)

A **TLS certificate** is a small file that says 'the public key for `example.com` is this one', signed by a **certificate authority** (CA) that your browser already trusts. When you open a site over HTTPS, the server sends its certificate. The browser checks that the signature is from a known CA, that the name matches the site you asked for and that it has not expired. If all three pass, you get the padlock and the browser uses the public key from the certificate to start encryption with that server, and nobody else.

The CA's job is to check, before signing, that whoever asked for the certificate actually controls the domain. Since 2015 Let's Encrypt does this automatically and for free: the server proves control by publishing a token the CA asked for, gets a certificate valid for 90 days, and renews it on its own. That is why nearly every site has HTTPS today and why 'SSL certificate', the old name, is still what many people call it.

What a certificate proves is narrow: that you are really talking to `mybank.com`. It says nothing about whether `mybank-secure-login.com` is honest; a phishing site can have a perfectly valid certificate for its own look-alike name. And an 'expired certificate' warning usually means an administrator forgot to renew, not an attack, although the safe move is still not to type anything there.

Click the padlock in your browser and you can read the certificate yourself: who issued it, for which names, and until when. It is the same mechanism, in reverse, that lets a company sign its software so your computer knows an update really came from them.

## An analogy

A passport. An authority the border guard trusts issued it, it binds a name to a face (a domain to a public key) and it expires. A valid passport proves identity, not good intentions.

## Keep in mind

- A certificate binds a domain name to a public key, signed by a trusted authority.
- The browser checks the signature, the name and the expiry date before showing the padlock.
- Let's Encrypt made certificates free and automatic; most sites renew every 90 days.
- It proves you reached the real domain, not that the domain is trustworthy.

## Go deeper

- [What is an SSL certificate? (Cloudflare Learning Center)](https://www.cloudflare.com/learning/ssl/what-is-an-ssl-certificate/)
- [Let's Encrypt: how it works](https://letsencrypt.org/how-it-works/)
- [Public key certificate on Wikipedia](https://en.wikipedia.org/wiki/Public_key_certificate)

## Related terms

- [Public-key cryptography](https://tidbit.legios.com.ar/public-key-cryptography/): Two linked keys: one you share with everyone to lock, one you keep to unlock.
- [Web browser](https://tidbit.legios.com.ar/web-browser/): The app that fetches web pages from the internet and draws them on your screen.
- [HTTPS](https://tidbit.legios.com.ar/https/): The padlock in your browser: web traffic nobody in between can read.
- [Server](https://tidbit.legios.com.ar/server/): A computer whose job is to answer requests from other computers, all day, every day.
- [Encryption](https://tidbit.legios.com.ar/encryption/): Scrambling data so that only someone with the key can read it.
- [Token](https://tidbit.legios.com.ar/token/): The small chunk of text a language model actually reads.
- [Phishing](https://tidbit.legios.com.ar/phishing/): A fake message that tricks you into handing over a password or a payment.
- [Domain name](https://tidbit.legios.com.ar/domain-name/): The readable name of a website, like wikipedia.org, that stands in for a numeric address.