When we see the small lock icon in the browser address bar, or when a website address starts with “https”, it means that we are communicating with the website via an encrypted connection established using the SSL/TLS protocol. The foundation of all this secure communication lies in the SSL certificate. It is more than just a digital file; it is the cornerstone of trust and security in the digital world, ensuring that data cannot be eavesdropped on, tampered with, or forged during transmission.
The core principles of SSL certificates and HTTPS encryption
An SSL certificate is a type of digital certificate that complies with the SSL/TLS protocol. Its primary function is to establish an encrypted and authenticated communication channel between the client (such as a web browser) and the server (such as a website).
The collaboration between asymmetric and symmetric encryption
The entire HTTPS handshake process cleverly combines two encryption techniques. First, the server sends its SSL certificate (which contains the public key) to the browser. The browser uses its built-in trusted root certificates to verify the authenticity of the server’s certificate. Once the verification is successful, the browser generates a random “session key” and encrypts it using the server’s public key, before sending it back to the server. Only the server, which possesses the corresponding private key, can decrypt this session key. Subsequently, both parties use this efficient symmetric session key to encrypt and decrypt the actual data being transmitted. This approach ensures the security of the key exchange (asymmetric encryption) while also maintaining the efficiency of encrypting large amounts of data (symmetric encryption).
Recommended Reading Comprehensive Analysis of SSL Certificates: Types, Application Processes, and Security Roles。
Key information in the SSL certificate
A standard SSL certificate contains several important pieces of information: the domain name of the certificate holder (Common Name), information about the holder's organization, the name of the certificate-issuing authority (CA), the public key of the certificate, the start and end dates of its validity period, and the digital signature of the issuing authority. This digital signature is crucial for establishing a trust chain; it verifies that the certificate was indeed issued by a trusted CA and that its contents have not been tampered with.
The main types of SSL certificates and their applicable scenarios
Based on different verification levels and features, SSL certificates are mainly classified into the following categories to meet the security and trust requirements of various scenarios.
Domain Validation SSL Certificate
DV证书是签发速度最快、成本最低的证书类型。CA仅验证申请者对该域名的控制权，通常通过验证指定邮箱（如[email protected]）或设置特定的DNS解析记录来完成。它不验证企业或组织的真实身份。
DV certificates are very suitable for personal websites, blogs, testing environments, or internal systems. They offer the same level of encryption, but the browser address bar only displays a lock icon, without showing the company name.
Organizational Validation SSL Certificate
OV certificates build upon the DV (Domain Validation) process by adding additional rigorous checks to verify the authenticity of the applying organization (such as a company or government agency). The CA (Certificate Authority) will verify the company’s registration information, physical address, and contact details (such as phone numbers). Due to the more extensive manual verification process, the issuance of an OV certificate typically takes several working days.
OV certificates are commonly used on corporate websites and e-commerce platforms where it is necessary to demonstrate the credibility of the entity to users. The verified company name can be viewed on the certificate details page of certain browsers.
Extended Validation SSL Certificates (EV SSL)
EV certificates are the most rigorously verified and highest-security certificates. The review process for these certificates is extremely thorough, involving not only organizational information but also the examination of legal documents. The most distinctive feature of EV certificates is that, in browsers that support them, the address bar will display a lock icon, as well as the name of the company that has passed the verification process, which is shown in a green box.
EV (Extended Validation) certificates were once widely used on websites that required a high level of trust, such as banks, financial institutions, and large e-commerce platforms. However, as browser user interfaces have evolved, some modern browsers no longer prominently display a green address bar. Nevertheless, the strict verification processes behind the issuance of EV certificates remain a symbol of the highest level of trust.
Recommended Reading SSL Certificate Comprehensive Analysis: From How It Works to Best Practices for Deployment。
Multiple domain and wildcard certificates
In addition to verifying the level of security, certificates are also classified based on the number of domains they cover. Single-domain certificates protect only one specific domain name (for example, www.example.com). Multi-domain certificates (SAN/UCC) allow protection of multiple different domain names within a single certificate (for example, example.com, shop.example.com, another.com). Wildcard certificates, on the other hand, can protect a primary domain name and all its subdomains at the same level (for example, *.example.com can protect blog.example.com, mail.example.com, etc.), making them very flexible and efficient for companies with a large number of subdomains.
How to apply for and deploy an SSL certificate
The first step in enabling HTTPS for a website is to obtain and correctly install an SSL certificate. Here is the standard process for applying for and deploying an SSL certificate:
Step 1: Generate a certificate signing request
This process is usually completed on your website server. You will need to use tools such as OpenSSL to generate a pair of keys (a private key and a public key), as well as a Certificate Signing Request (CSR) file. The CSR file contains your domain name, organizational information, and the public key. Make sure to keep the generated private key securely; it is essential for decrypting communications and must not be lost.
Step 2: Submit an application and undergo verification with the CA (Certificate Authority).
Select a reputable certificate authority (CA) or a dealer that works with them, submit your CSR (Certificate Signing Request) file, and complete the verification process according to the type of certificate you have chosen (DV, OV, or EV). For DV certificates, the verification is usually completed automatically within a few minutes to a few hours. For OV/EV certificates, you will need to provide additional documentation to the CA and wait for manual review.
Step 3: Download and install the certificate
After the verification process is completed, the CA will issue an SSL certificate file to you (usually in the.crt or.pem format). You need to upload this certificate file, along with the certificate chain file (the intermediate certificates), to your web server (such as Nginx, Apache, IIS, etc.). In the server configuration, make sure to set the correct paths for the certificate file, the private key file, and the certificate chain file, and then restart the server service to enable HTTPS.
Step 4: Future Maintenance and Updates
SSL证书有固定的有效期（目前最长为13个月）。您必须在证书过期前续费并重新签发、安装新证书。建议设置提醒，或使用支持自动续期的服务（如Let‘s Encrypt的ACME协议），以避免因证书过期导致网站访问被浏览器拦截。
Recommended Reading Comprehensive Analysis of SSL Certificates: Types, Selection Guidelines, and Detailed Installation Procedures。
summarize
SSL certificates are essential components for implementing HTTPS encryption and ensuring the security of data transmission over the internet. They work by combining asymmetric and symmetric encryption to protect the confidentiality and integrity of data, and they also provide server authentication through the verification process conducted by Certificate Authorities (CAs). From basic DV (Domain Validation) certificates to highly trusted EV (Extended Validation) certificates, as well as flexible multi-domain and wildcard certificates, different types of SSL certificates offer suitable security solutions for various websites and use cases. Understanding the principles, types, and application processes of SSL certificates is a fundamental skill for every website owner, developer, and operations personnel who aim to build a secure and trustworthy online environment. In an era where HTTPS is widely adopted, configuring the right SSL certificate for your website is not only a necessary measure to protect user data but also a crucial step in establishing a professional brand image and gaining the favor of search engines.
FAQ Frequently Asked Questions
Are there any differences in the encryption strength of DV, OV, and EV certificates?
There is no difference. Regardless of the type of SSL certificate, the strength of the transport layer encryption provided is the same. The main differences lie in the rigor of the authentication process for the applicant and the way the information is displayed in the browser. The core TLS protocol and the key exchange mechanism ensure the same level of encryption security.
What is the difference between a free SSL certificate and a paid one?
免费证书（如Let’s Encrypt颁发的）通常是DV证书，提供了与付费DV证书相同的加密强度。主要区别在于服务支持、保险赔付和证书功能。付费证书通常提供更好的技术支持、针对证书错误导致损失的经济赔偿（担保），以及更多的功能选项（如OV/EV验证、多域名支持等）。免费证书有效期较短（如90天），需要更频繁地自动续期。
Is a website necessarily secure after installing an SSL certificate?
Not necessarily. SSL certificates primarily ensure the security of data during transmission (from the user’s browser to the server), meaning they prevent eavesdropping and tampering with the data. However, they do not protect the server itself from hacker attacks, nor can they prevent malicious code (such as XSS attacks) from being implanted on a website, nor do they guarantee that the website’s application logic is free of vulnerabilities. Website security is a systematic effort, and SSL/TLS encryption is just one of the crucial components of this process.
What could be the reasons for a browser to display a message indicating that a certificate is not secure?
Common reasons for this warning include: the certificate has expired; the domain name for which the certificate was issued does not match the domain name you are accessing; the certificate chain is incomplete or incorrectly configured; the certificate was issued by a root certificate that is not trusted by the browser (such as a self-signed certificate); or the SSL/TLS protocol version or encryption suite configuration on the server is insecure. You need to investigate the issue based on the specific error message provided.
Can wildcard certificates protect all subdomains?
Wildcard certificates (such as *.example.com) can protect all subdomains at the same level, but they cannot protect subdomains at multiple levels. For example, a *.example.com certificate can protect blog.example.com and mail.example.com, but it cannot protect dev.www.example.com (which is a subdomain at a lower level). To protect subdomains at a lower level, you need a separate certificate or a multi-domain certificate.
What's next, what's next?
Extended reading and practical knowledge
The following are related to the topic of this article and are suitable for further in-depth reading. Prioritize starting with the article that is closest to your current problem, and gradually expanding to surrounding topics usually works better.
- Domain Name Resolution, Management, and Best Practices: From Beginner to Expert
- What is an SSL certificate? An ultimate guide to applying for, configuring, and understanding different types of SSL certificates
- Comprehensive Analysis of SSL Certificates: Principles, Purchase, and Installation Guide
- What is an SSL certificate? How does it protect the security of your website?
- SSL Certificate Overview: Types, Principles, and Deployment Guidelines
English