When we see the small lock icon in the browser address bar, or when a website address starts with “https”, it is the SSL certificate that is working quietly in the background. SSL certificates are not only a symbol of website security but also the cornerstone of the modern internet’s trust system. Understanding SSL certificates is crucial for anyone who owns or develops websites, as well as for ordinary users.
The core principles of SSL certificates: Asymmetric encryption and the trust chain
The core technology of SSL certificates is based on the asymmetric encryption (public-key encryption) system. This system consists of a pair of keys: a public key and a private key. The public key can be made available to anyone and is used to encrypt data, while the private key must be kept strictly confidential and is used to decrypt data that has been encrypted with the corresponding public key. When you visit a website that has an SSL certificate installed, your browser retrieves the public key of that website’s server.
The key to this process lies in “trust transfer.” Browsers come with a pre-installed list of trusted root certificate authorities (CAs). An SSL certificate is essentially a “digital signature” of a website’s public key, along with proof of its identity, issued by one of these CAs. The CA verifies the identity of the applicant (such as the domain name owner and organizational information) and then signs the certificate using its own private key. Since browsers trust the root CAs, they also trust all certificates issued by these root CAs, thereby establishing a chain of trust from the browser to the website.
Recommended Reading Comprehensive Analysis of SSL Certificates: An Integrated Guide from Application to Deployment and Renewal。
The main types of SSL certificates and how to choose them
Based on the level of validation and the functions they provide, SSL certificates are mainly divided into three categories to meet the security and trust requirements of different scenarios.
Domain Validation Certificate
DV (Domain Validation) certificates are the fastest-to-issue and lowest-cost type of certificate. The Certificate Authority (CA) only verifies the applicant's control over the domain name, for example, by sending a verification email to the email address registered for that domain or by placing a specific file in the website’s root directory. While DV certificates provide encryption for communications, they do not verify the true identity of the website owner. As such, they are ideal for personal blogs, testing environments, or internal systems.
Organizational validation type certificate
OV certificates build upon the DV (Domain Validation) process by additionally verifying the legal entity information of the applying organization (such as a company or government agency). The Certificate Authority (CA) will check the company’s business license, contact information, and other relevant documents. The certificate details will include the verified name of the organization, providing visitors with an additional level of trust. These certificates are commonly used for corporate websites and e-commerce platforms.
Extended Validation Certificate
EV certificates are the most rigorously verified and highest-security certificates. The application process is extremely thorough, with CAs (Certification Authorities) conducting extensive offline reviews. Websites that use EV certificates will have the company name displayed in green in the address bar of most browsers, which is the most direct signal of trust to users. Websites in industries with high trust requirements, such as finance, payments, and large e-commerce platforms, typically use EV certificates.
In addition, based on the number of domains they cover, there are single-domain certificates, multi-domain certificates, and wildcard certificates. Wildcard certificates can protect a primary domain name and all its subdomains at the same level.
Recommended Reading SSL certificate: the core mechanism for ensuring the secure transmission of website data。
SSL/TLS Handshake Process Explained
“The ”S“ in ”HTTPS” stands for “Secure,” and the secure connection is established through the TLS handshake protocol. Although this process is completed in an instant, it involves precise steps.
When a client (browser) first attempts to connect to an HTTPS server, it sends a “Client Hello” message, which includes the TLS versions it supports, a list of available encryption suites, and a random number.
The server responds with a “Server Hello” message, selecting the TLS version and encryption suite that are supported by both parties, and then sends its own random number. Subsequently, the server sends its SSL certificate (which contains the public key).
The client verifies the certificate. It checks whether the certificate was issued by a trusted CA, whether it is still within its validity period, and whether the domain name matches the one being used. Once the verification is successful, the client generates a “pre-master key,” encrypts it using the server’s public key, and then sends it to the server.
The server uses its own private key to decrypt and obtain the pre-master key. At this point, both the client and the server generate the same “session key” independently, using two random numbers and the pre-master key. All subsequent application-layer data will be encrypted and decrypted using this symmetric session key, as symmetric encryption is much more efficient than asymmetric encryption.
The handshake has been completed, and a secure encrypted channel has been established. The transmission of encrypted HTTP data has now begun.
Recommended Reading A Comprehensive Analysis of SSL Certificates: From Basic Concepts to a Complete Guide for Applying and Installing Them。
Practical Guide: How to Obtain and Deploy SSL Certificates
The process of obtaining and deploying SSL certificates has become very convenient.
First, you need to generate a Certificate Signing Request (CSR). On your server (for example, using OpenSSL tools), generate a pair of keys and create a CSR file that contains your public key as well as your organization’s information.
Then, submit a CSR (Certificate Signing Request) to the CA to obtain the certificate. You can choose a global CA or a reputable domestic CA. Depending on the type of certificate you select, complete the corresponding verification processes (such as domain name verification and organization verification).
After the verification is successful, the CA will issue the certificate file (which usually includes the.crt file and, possibly, an intermediate certificate chain). Finally, deploy the certificate file along with the private key you generated initially to your web server software (such as Nginx, Apache, IIS, etc.) and configure it to enforce HTTPS connections.
如今，为了简化流程并促进HTTPS普及，有了更简单的选择：Let‘s Encrypt。它是一个免费、自动化、开放的CA，提供DV证书。通过其提供的Certbot等客户端工具，可以几乎一键式地完成证书申请、验证、部署和自动续期，极大降低了使用HTTPS的门槛。
summarize
An SSL certificate is by no means a simple technical component; it is the cornerstone of building a secure and trustworthy internet environment. From the fundamental principles of asymmetric encryption to the rigorous CA (Certificate Authority) trust system, and finally to the sophisticated TLS handshake protocol, all these elements together create the “great wall of security” that protects HTTPS connections. Understanding the differences between various types of certificates helps us make informed decisions regarding the balance between cost and trust; mastering the practical processes from application to deployment is an essential skill for every website operator. In an era where cyberattacks are becoming increasingly frequent, deploying effective SSL certificates for websites has evolved from being a best practice to a fundamental responsibility.
FAQ Frequently Asked Questions
Are SSL certificates and TLS certificates the same thing?
Yes, it usually refers to the same thing. SSL is the predecessor of TLS. Since the name “SSL” became more widely known to the public earlier, the industry has traditionally continued to refer to these digital certificates used for encryption and authentication as “SSL certificates,” even though the technology now uses the later TLS protocol.
Are there any differences between free SSL certificates (such as Let's Encrypt) and paid certificates?
The core encryption capabilities are the same; both types of certificates offer the same level of HTTPS encryption. The main differences lie in the level of verification and the additional services provided. Free certificates are usually DV (Domain Validation) certificates, which only verify the ownership of the domain name. Paid OV (Organization Validation) or EV (Extended Validation) certificates provide additional verification of the organization’s identity, thereby increasing user trust. Paid certificates also typically come with more valuable warranty and support options, as well as more flexible certificate management features.
Why does my website still display “Unsecure” even though I have installed an SSL certificate?
There are usually several reasons for this situation. The most common one is that the webpage contains mixed resources (such as images, scripts, or style sheets) that are loaded using the HTTP protocol, which makes the entire page appear insecure to the browser. Another possible cause could be an expired certificate, a mismatch between the certificate’s domain name and the domain name being visited, or an incomplete certificate chain (lack of intermediate certificates). It is necessary to investigate the issue based on the specific warning messages provided by the browser.
Do SSL certificates need to be updated regularly?
Yes, SSL certificates have a clear expiration date, which is usually one year or even shorter (for example, 90 days). Once a certificate expires, the browser will display a severe warning indicating that the connection is not secure. Therefore, it is essential to renew the certificate and redeploy it before it expires. Using automated tools or choosing a CA (Certificate Authority) service that provides automatic renewal alerts can help prevent this issue.
What's next, what's next?
Extended reading and practical knowledge
The following are related to the topic of this article and are suitable for further in-depth reading. Prioritize starting with the article that is closest to your current problem, and gradually expanding to surrounding topics usually works better.
- CDN Technology Analysis: A Guide to Website Acceleration and Security Protection, from Beginner to Expert
- In-Depth Explanation of CDN Technology: From Principles to Practice – The Ultimate Guide to Improving Website Performance and Security
- In today's internet environment, data security is a critical issue that concerns both users and website owners.
- SSL certificate: the core mechanism for ensuring the secure transmission of website data
- A Comprehensive Analysis of SSL Certificates: From Basic Concepts to a Complete Guide for Applying and Installing Them
English