In the exchange of information over the internet, data is at risk of being eavesdropped on, tampered with, or impersonated during transmission. The SSL/TLS protocol was developed precisely to address these security issues. Its core principle is to establish an encrypted and authenticated secure channel between the communicating parties.
The SSL certificate is the foundation of trust that enables the implementation of this protocol. It is essentially a digital file that links the identity information of a website (such as the domain name and company name) with a public key. When a user visits a website that has an SSL certificate installed, the browser performs a series of “handshake” operations with the server to verify the authenticity and validity of the certificate. Afterwards, the browser uses the public key from the certificate to negotiate a temporary, high-security symmetric session key. All data transmitted thereafter is encrypted using this session key, ensuring that even if the data is intercepted during transmission, it cannot be decrypted.
This process not only ensures the confidentiality of the data but also verifies that “the website you are accessing is indeed the one you think it is” through the endorsement of a certificate authority, thereby providing authentication. The “little lock” icon displayed in the address bar and the “HTTPS” prefix are clear indicators of this secure connection.
Recommended Reading What is an SSL certificate? From its principle to its deployment, it comprehensively ensures the security of data transmission on websites。
The core working principle of SSL certificates
To understand how SSL certificates work, we need to delve into the cryptographic principles and communication processes that underlie them.
The combination of asymmetric encryption and symmetric encryption
In the SSL/TLS protocol, the advantages of both asymmetric and symmetric encryption are cleverly combined. Asymmetric encryption (such as RSA and ECC) uses a pair of keys: a public key and a private key. The public key can be freely distributed for encrypting data, while the private key is kept secret by the owner and is used for decrypting the data. Although it offers high security, asymmetric encryption is computationally expensive and relatively slow.
Symmetric encryption (such as AES) uses the same key for both encryption and decryption, which results in fast computation speeds and makes it suitable for encrypting large amounts of data. However, the process of distributing the key is not secure over the network.
The SSL/TLS handshake process perfectly resolves this contradiction: it first uses asymmetric encryption to securely exchange a “session key” that will be used for symmetric encryption, and all subsequent communications are then encrypted using this fast, symmetric session key.
SSL/TLS Handshake Process Explained
When a client (browser) attempts to connect to an HTTPS website, the following key steps are triggered:
Recommended Reading SSL Certificates: The Ultimate Guide to SSL Certificates from Role, Types to Application and Installation。
1. “Client Hello”: The client sends a connection request to the server, indicating the SSL/TLS versions it supports, a list of available encryption protocols, and a random number.
2. “Server Hello”: The server responds by selecting the SSL/TLS version and encryption suite that are supported by both parties, and then sends its own random number.
3. The server sends the certificate: The server sends its SSL certificate (which contains the public key) to the client.
4. Certificate Verification: The client verifies the validity of the certificate. The verification includes checking whether the certificate was issued by a trusted certificate authority, whether the certificate is still within its validity period, and whether the domain name in the certificate matches the domain name being accessed. If the verification is successful, the client trusts the server’s public key.
5. Key Exchange: The client generates a “pre-master key,” encrypts it using the server’s public key, and then sends it to the server. Only the server, which possesses the corresponding private key, can decrypt the pre-master key.
6. Generating Session Keys: The client and server use the two random numbers they exchanged earlier, along with the pre-master key, to independently generate the same “master key” and “session key”.
7. The handshake is completed when both parties exchange “completion” messages encrypted using the session key, confirming that the encryption and decryption channels have been successfully established. All application-layer data (such as HTTP requests) is then transmitted through this secure, symmetrically encrypted channel.
The main types of SSL certificates and how to choose them
Not all SSL certificates are the same; they are primarily classified into the following types based on the level of verification and the scope of coverage, in order to meet various security and business requirements.
Domain Validation Certificate
DV (Domain Validation) certificates are the fastest and most cost-effective type of certificate to obtain. The certification authority only verifies the applicant’s control over the domain name, for example, by adding specific records to the domain’s DNS or by checking if emails are received at the designated email address. The verification process is fully automated and usually takes just a few minutes to complete.
DV (Domain Validation) certificates only provide basic encryption capabilities, ensuring that communications under that domain name are encrypted. However, they do not provide any information about the identity of the organization or individual operating the domain. DV certificates are suitable for personal websites, blogs, test environments, or internal services.
Organizational validation type certificate
The OV certificate builds upon the DV (Domain Validation) process by adding a rigorous manual review of the authenticity of the applying organization (such as a company or government agency). The CA (Certificate Authority) verifies the organization’s business registration information and its legal status. This organizational information is recorded within the certificate, and users can view it by clicking on the lock icon in the browser’s address bar.
OV certificates not only provide encryption but also offer reliable authentication, effectively protecting against phishing websites. They are suitable for use on corporate websites, e-commerce platforms, and other scenarios where it is necessary to demonstrate a legitimate and trustworthy identity.
Recommended Reading What is SSL Certificate。
Extended Validation Certificate
EV certificates represent the highest level of validation and are the most stringent type of certificate. In addition to the rigorous OV (Organizational Validation) review process, the CA (Certificate Authority) also conducts more in-depth checks to verify the actual existence and operational status of the organization. EV certificates have the most prominent visual appearance in browsers: in some browsers before 2026, the address bar would display the company name in green and with highlighted text.
Although the visual feature of a green address bar has gradually been unified to a lock icon in subsequent updates of major browsers, EV (Extended Validation) certificates still represent the highest level of security and trust. They are the preferred choice in industries with extremely high trust requirements, such as finance, payments, and large enterprises.
Wildcard certificates and multi-domain certificates
Based on the coverage area:
* 通配符证书： 一张证书可以保护一个主域名及其同一级的所有子域名。例如，*.example.com The certificate can be used for www.example.com, mail.example.com, shop.example.com It’s very convenient to manage.
* 多域名证书： 一张证书可以在其“主题备用名称”字段中保护多个完全不同的域名。例如，可以将 example.com, example.net, example.org All of these elements are included in a single certificate. This is ideal for companies that own multiple domain names.
How to apply for and deploy an SSL certificate
From obtaining to installing and deploying an SSL certificate, the entire process is systematic and well-structured.
Certificate Application Process
1. Generate a private key and a Certificate Signing Request (CSR): Use a tool such as OpenSSL on your server to create a private key file and a corresponding CSR file. The CSR contains your public key, as well as the domain name you wish to use and your organization’s information. The private key must be kept absolutely confidential and securely backed up.
2. Submit the CSR and select the verification method: Submit the CSR to the selected CA (Certificate Authority) or certificate reseller. Complete the verification process according to the type of certificate you purchased (DV, OV, EV). For DV certificates, domain name control is typically verified simply through DNS or file validation.
3. Issue and download the certificate: After the verification is successful, the CA will issue the certificate. You will need to download the certificate package, which contains the server certificate (and possibly intermediate certificates as well).
Server Deployment Guide
After obtaining the certificate file, it needs to be configured on the web server. Here are some key steps and important points:
- Nginx: Use it in the server configuration block.
ssl_certificateThe command specifies the paths to the server certificate and the intermediate certificate chain files; use them accordingly.ssl_certificate_keyThe command specifies the path to the private key file. It is also necessary to listen on port 443 and enable SSL. - Apache: Usage
SSLCertificateFileThe instruction specifies the server certificate.SSLCertificateKeyFileSpecify the private key.SSLCertificateChainFileSpecify the intermediate certificate chain. - Tomcat: Typically, the certificate and private key are imported into a Java Keystore file, and then…
server.xmlThe Connector configuration refers to this file.
Key Security Configurations:
* 禁用不安全的协议： 在配置中明确禁用已过时、不安全的SSLv2、SSLv3，甚至早期的TLS 1.0和TLS 1.1。
* 使用安全的加密套件： 优先配置使用前向保密的加密套件（如ECDHE）。
* 强制HTTPS重定向： 通过配置将所有HTTP请求（80端口）永久重定向到HTTPS地址，确保用户始终使用安全连接。
Post-installation verification and monitoring
After the deployment is complete, verification must be carried out:
1. Visit your HTTPS website using a browser to ensure that there are no security warnings, and that the lock icon is displayed correctly.
2. Use online SSL testing tools (such as SSL Labs’ SSL Server Test) to scan your website. These tools generate detailed reports that assess the security level of your configuration and identify any potential issues.
3. Set up a certificate expiration reminder. Certificates usually have a validity period of 1 year; make sure to renew and replace them in a timely manner before they expire, otherwise, the website will become inaccessible.
summarize
SSL certificates have evolved from an optional security enhancement to an essential component of the internet infrastructure. By understanding the principles behind the combination of asymmetric and symmetric encryption, businesses can make informed decisions when selecting between different types of certificates (such as DV, OV, EV) and various certificate formats (including wildcards and multiple domain names) based on their specific security and trust requirements. The entire deployment process – from generating the correct CSR (Certificate Signing Request), going through verification, to configuring security settings on the server, and conducting ongoing monitoring – is critical. Deploying the right certificate and ensuring its validity is not only a matter of respecting users’ data privacy but also a fundamental step in establishing a trustworthy image for your website and meeting compliance requirements. In an era of increasingly complex cybersecurity threats, enabling HTTPS for your website is the first and most crucial step towards secure operations.
FAQ Frequently Asked Questions
What are the differences between free SSL certificates and paid SSL certificates?
主要区别在于验证级别、功能、服务支持和保险保障。免费证书（如Let‘s Encrypt）通常是DV证书，提供基础的加密功能，适合个人和小型项目。它的有效期较短（90天），需要定期自动续签，且通常不包含技术支持或针对证书问题导致损失的任何保险。
Paid certificates not only offer higher levels of authentication such as OV (Organizational Validation) and EV (Extended Validation), which enhance user trust, but also typically come with longer validity periods, professional technical support services, and a certain amount of financial compensation provided by the CA (Certificate Authority). They are therefore more suitable for commercial websites and enterprise applications.
Why does the browser still indicate that the connection is insecure even after the SSL certificate has been deployed?
There are usually several reasons for this: First, the website page contains mixed resources that use the HTTP protocol (such as images, scripts, and style sheets), and all of these resource links need to be changed to HTTPS. Second, the SSL certificate is not deployed correctly; for example, the certificate chain is incomplete (missing intermediate certificates), or the domain name of the certificate does not match the domain name being visited. Third, the server is not configured properly, allowing users to access the site via HTTP. It is necessary to check and ensure that HTTPS is used across the entire website.
How long is the validity period of an SSL certificate?
According to industry regulations, starting from 2026, SSL/TLS certificates issued by major certificate authorities (CAs) will have a maximum validity period of 90 days. This measure is designed to enhance security and encourage faster technological updates as well as more frequent key rotations. As a result, website administrators are required to implement automated certificate management processes to ensure that certificates are renewed and replaced in a timely manner, in order to prevent website service interruptions due to certificate expiration.
Does the message “The connection is secure” displayed by the browser mean that the website is absolutely trustworthy?
“The connection is secure” mainly implies two things: First, the communication between you and the website server is encrypted, making it difficult for third parties to eavesdrop on or tamper with the data. Second, the domain name you are accessing matches the domain name specified in the certificate. However, this does not directly mean that the content of the website is benign or legitimate. A malicious website can still obtain a legitimate DV certificate for its domain name. To assess the credibility of a website, users need to consider various factors, such as the website’s content, the reputation of the vendor, and whether the website has any form of authentication (OV/EV certificates can provide some information).
What's next, what's next?
Extended reading and practical knowledge
The following are related to the topic of this article and are suitable for further in-depth reading. Prioritize starting with the article that is closest to your current problem, and gradually expanding to surrounding topics usually works better.
- What is an SSL certificate? A comprehensive explanation from its principles to the process of applying for and using it.
- What is an SSL certificate? A comprehensive guide to understanding the principles, types, and installation procedures of digital certificates.
- In-depth Analysis of SSL Certificates: From Beginner to Expert – Comprehensive Protection for Website Security
- What is an SSL certificate and how does it work
- Comprehensive Guide to SSL Certificates: From Principles and Types to Practical Details on Deployment and Management
English