TLS & certificates
What a certificate actually tells your browser
A practical introduction to domain names, certificate chains and automatic renewal.
A name, a key and a chain
A website certificate binds one or more DNS names to a public key. The browser checks that the requested name appears in the certificate, that the certificate is within its validity period, and that the issuing chain leads to a trusted certificate authority.
Encryption and identity
TLS protects data while it travels between a browser and a web server. A valid certificate establishes the identity of the domain; it does not certify the accuracy of everything published on the website.
Keeping renewal routine
Short certificate lifetimes make automation useful. An ACME client proves control of a domain, obtains a certificate, and renews it before expiry. The web server must reload the renewed certificate rather than continue serving an older copy.
Reading a browser warning
A name mismatch, an expired certificate and an unknown issuer are different failures. Check the hostname, local clock and certificate details before proceeding. An unexpected warning should be investigated rather than dismissed.