Deutsch
Servers, HTTP & caching

SSL/TLS certificate

An SSL/TLS certificate is a digital file that binds a public key to a domain name, so that a browser can check it is talking to the right server before it sets up an encrypted HTTPS connection. The name SSL is historical: SSL is the predecessor of TLS, and current connections use TLS. TLS 1.3 was published as RFC 8446 in 2018. The term “SSL certificate” has stayed in common use.

What is in a certificate?

A certificate holds the public key, the identity of the owner (the subject, which includes the domain names it covers), the validity period and a digital signature from a certificate authority (CA). Browsers ship with a list of trusted CAs. A server certificate is normally linked through an intermediate certificate to a CA root certificate, and the browser follows this chain of trust to the root.

Validation levels

  • Domain validated (DV): the CA only verifies control of the domain.
  • Organization validated (OV): the CA also verifies the organization behind it.
  • Extended validation (EV): the most thorough check of the organization.

Let’s Encrypt issues free DV certificates only, because OV and EV cannot be automated. They are valid for 90 days, and the project recommends renewing every 60 days. Under the CA/Browser Forum Baseline Requirements, the maximum validity of publicly trusted certificates drops in steps to 200 days from March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029, so renewals become more frequent. Many hosting providers handle issuance and renewal automatically (assessment).

SEO relevance

A certificate is a precondition for HTTPS, and browsers show a full-page warning when it has expired or does not match the domain. Visitors and crawlers that meet the error cannot load the page normally. Monitoring expiry dates avoids this.

Example

Text
Subject:  CN=www.example.com
Issuer:   Example Intermediate CA
Valid:    2026-09-01 to 2026-11-30

Common mistakes

The HTTPS guide on web.dev (last updated 2015) names these pitfalls.

  • Wildcard certificate across several levels. A wildcard applies to only one DNS label. *.example.com works for foo.example.com, but not for foo.bar.example.com.
  • Expired certificate with HSTS enabled. Clients that have listed the site as a known HSTS host are likely to hard-fail if the site has a TLS configuration error such as an expired certificate.
  • HTTP resources on HTTPS pages. Some browsers refuse to load or execute them, which breaks the page.
  • Hardcoded protocols in internal links. The guide lists this as a common mistake too.

Sources

  1. The Transport Layer Security (TLS) Protocol Version 1.3, RFC 8446rfc-editor.org
  2. Transport Layer Security (TLS) – MDN Web Docsdeveloper.mozilla.org
  3. FAQ – Let's Encryptletsencrypt.org
  4. Baseline Requirements – CA/Browser Forumcabforum.org
  5. What is an SSL certificate? – DigiCertdigicert.com
  6. Enable HTTPS on your servers – web.dev (2015)web.dev

Last updated: