What Is an SSL Certificate and How Does It Work?
SSL certificates authenticate websites and encrypt data in transit. This guide explains what a certificate contains, how TLS handshakes work, and what to check before your certificate expires.
ProfitTool Team
Security & Dev
SSL vs TLS
Despite the name, modern websites use TLS (Transport Layer Security), not the older SSL (Secure Sockets Layer). SSL was deprecated in 2015. The term "SSL certificate" persists in common usage but refers to X.509 certificates used by TLS.
What a Certificate Contains
An X.509 certificate is a digitally signed document that binds a public key to an identity. It includes:
- Subject: the domain name (or organisation) the certificate is issued for
- Subject Alternative Names (SANs): additional domains or subdomains covered
- Issuer: the Certificate Authority (CA) that signed the certificate
- Validity period: not-before and not-after dates
- Public key: the asymmetric key used during the TLS handshake
- Serial number: unique identifier assigned by the CA
- Signature: the CA's digital signature proving authenticity
The TLS Handshake (Simplified)
- Browser connects to server, sends supported TLS versions and cipher suites
- Server responds with its certificate and chosen cipher suite
- Browser verifies the certificate against trusted CAs in its root store
- Both sides derive a shared symmetric session key
- All subsequent data is encrypted with that session key
Certificate Types
| Type | Validation | Use case |
|---|---|---|
| DV (Domain Validation) | DNS/HTTP challenge only | Most websites, blogs |
| OV (Organisation Validation) | Company identity verified | Business websites |
| EV (Extended Validation) | Rigorous legal verification | Banks, e-commerce |
| Wildcard | Covers *.domain.com | Multi-subdomain deployments |
| Multi-SAN | Covers multiple specific domains | SaaS, multi-domain setups |
Why Certificates Expire
Certificates expire (typically after 90 days for Let's Encrypt, up to 398 days for commercial CAs) to limit the window of exposure if a private key is compromised and to force regular re-validation of domain control.
What Happens When a Certificate Expires
Browsers display a full-screen warning that blocks users from proceeding. Search engines may reduce rankings or de-index the site. API clients and mobile apps will refuse to connect.
Check any domain's SSL certificate expiry date with our SSL Certificate Checker.
ProfitTool Team
Security & DevWritten and maintained by the ProfitTool team. Where an article references a ProfitTool utility, the behaviour described is the behaviour of the tool on this site — you can open it and check the output yourself.
More from the Knowledge Hub
SSL vs TLS: What Is the Difference?
SSL and TLS are both protocols for encrypting internet connections, but they are not the same. This guide explains the history, the differences, and why only TLS should be used today.
Privacy & SecurityHow to Check SSL Certificate Expiry: 5 Methods
An expired SSL certificate blocks all users with a hard browser warning. Here are five ways to check certificate expiry before it becomes a problem.
Privacy & SecurityWhat Is a Wildcard SSL Certificate?
A wildcard SSL certificate secures a domain and all its direct subdomains with one certificate. How they work, why they stop at one level, and when to use one.