What Is an SSL/TLS Certificate?

Ever wonder what makes the padlock icon appear in the address bar in some browsers (e.g., Firefox, Safari) and only “this connection is secure” types of messages display in others? The answer is an SSL certificate — it’s what allows organizations to serve their websites over the secure HTTPS protocol.  

Without an SSL certificate, a website is insecure, unverified, and no one has a reason to trust it (nor should they). Having one installed is the difference between a website ranking on Google and it falling into the search engine black hole, where sites go to die.  

What Is an SSL/TLS Certificate? 

In the most basic sense, an SSL/TLS certificate is a small data file you install on your server to make the https:// appear at the beginning of your website address (instead of http://). This secures your users’ data, transmitting it across the internet using a secure, encrypted channel.  

An SSL certificate (or, more accurately, a TLS certificate) assures website visitors of three important things: 

1. You’re connected to the real website shown in your address bar (not an imposter). If the website uses a business-validated SSL certificate, it can also show the user the verified organization that operates the website  

2. Data exchanged with the website is encrypted 

3. Data you send or receive can’t be tampered with 

But what does it look like when a website uses an SSL/TLS certificate? Let’s take a look: 

What Does an SSL Certificate Do? 

An SSL certificate contributes to three very pivotal elements of security on the internet:  

1. Identity authentication over an insecure network using verified identity 

2. Data confidentiality and security protection via public key encryption 

3. Data integrity assurance via cryptographic functions  

To better understand what an SSL certificate is, it’s crucial to first understand what it does. Let’s explore these concepts more in depth. 

1. An SSL Certificate Authenticates Your Website to Site Visitors and Clients 

A basic SSL certificate is issued and digitally signed by a third-party certification authority (CA) after it verifies that you control the domain. (If you can’t prove it, then the CA won’t issue the certificate.) This protects users against several types of cyber attacks (such as DNS poisoning attacks) that cybercriminals use to redirect popular domains to fake websites they control. 

However, a bad guy can still install a basic SSL/TLS certificate to display the padlock icon on any domain they own/control. This is where having a verified digital identity is crucial. For higher validation certificates (i.e., organization [OV] and extended validation [EV] certificates), CAs take additional steps to verify your organization’s information. 

These additional layers of identity validation prove who owns the website, protecting users against domains controlled by an imposter.  

Related: Learn more about how SSL/TLS authentication works 

2. An SSL Certificate Encrypts Data in Transit 

An SSL certificate enables public key cryptography to encrypt the connections used to submit sensitive information. This enables your web server (website, web apps, etc.) to securely receive all types of sensitive information from connecting parties via secure, encrypted channels, including:  

• bank account or credit card details,  

• login credentials,  

• intellectual property,  

• trade secrets, and  

• other secure communications. 

Related: Learn more about how SSL/TLS encryption works 

3. An SSL Certificate Guarantees Data Integrity in Transit 

SSL/TLS uses a combination of encryption and a cryptographic process known as hashing, to assure that data is legitimate, secure, and hasn’t been altered since it was signed. This is known as data integrity protection. 

This protects users from bad actors from editing the data they send to/from a website. For example, inserting ads or malware into legitimate web pages a user is viewing.  

What Info Does an SSL/TLS Certificate Contain? 

Now that we understand what an SSL certificate is and what it does, it’s time to explore the certificates themselves. The screenshot on the right (i.e., the SSL/TLS certificate for Microsoft’s live.com login page) is an example of what an SSL certificate looks like and what data it contains.  

There are several key pieces of data that are contained within SSL/TLS certificates (as highlighted in the graphic to the right): 

• The common name (CN) of the domain that the certificate is associated with 

• Which entity (organization) the certificate was issued to  

• The name of the CA that issued it 

• The certificate hierarchy that it chains back to 

• The certificate’s issuance and expiration dates 

• Any subject alternative name (SAN) domains covered by the certificate, including subdomains (optional)  

• The certificate’s public key 

How Does an SSL/TLS Certificate Work? 

Once installed on your server, an SSL certificate enables the use of the secure HTTPS protocol. When a user attempts to connect to your website, it’ll launch a process known as the SSL/TLS handshake, which entails verifying three key attributes: authentication, confidentiality, and data integrity verification.

What does this mean? Basically, the SSL/TLS handshake enables the user’s web client and your web server to:  

• verify that your website’s certificate was issued by a trusted certificate authority, 

• negotiate how they want to communicate throughout the rest of the session, 

• securely exchange key-related data via an asymmetrically encrypted channel, and 

• create a shared key that can be used to exchange data for the rest of the session using a symmetrically encrypted connection.  

What Can an SSL/TLS Certificate Secure?  

Conversations about SSL/TLS certificates virtually always focus on website data security. However, the truth is that these certificates aren’t only for websites; you can use them to secure a wealth of server-to-server communications and email data in transit, too. For example: 

• single sign-on (SSO) authentication data exchanges 

• virtual private network (VPN) connections 

• email servers’ communications* 

• webmail services* 

• VoIP connections 

• web app and API connections 

• IoT devices’ connections 

(*To secure the emails themselves (i.e., the messages, any files and attachments, etc.), you’d also need a separate S/MIME secure email certificate. This provides end-to-end encryption by securing the message before it leaves your inbox and while it sits on the recipient’s server.)   

Types of SSL/TLS Certificates (Use Cases and Validation Levels) 

SSL certificates come in multiple varieties based on use cases (i.e., coverage types) and domain or business validation levels. This means there are several types of server certificates to choose from, based on your organization’s specific needs and use cases.  

Domain and Business Validation Levels 

• Domain validation (DV) certificate — This certificate offers the lowest level of assurance, only proving that the domain is owned by the certificate requester.  

• Organization validation (OV) certificate — This certificate builds on top of the domain validation to verify the organization that controls the domain.   

• Extended validation (EV) certificate — This certificate offers the highest level of identity validation and assurance that users are connecting to your company’s legitimate website. (This is not available for wildcard SSL/TLS certificates.) 

SSL/TLS Certificates by Use Cases 

	Single Domain SSL Certificate	Multi-Domain SSL Certificate	Wildcard SSL Certificate
Secures	One domain (includes www and non-www)	Multiple domains and/or subdomains	One domain and unlimited subdomains
Example	example.com www.example.com	example.com www.example.com example.net	example.com www.example.com blog.example.com dev.example.com
Validation Options	All	All	Only DV or OV
	Buy Now	Buy Now	Buy Now

What Does an SSL Certificate Look Like? Here Are Several Examples 

If you’re looking for an SSL certificate example, then you’ve come to the right place. By and large, server certificates mostly look the same. There are a few differences in terms of what they do and the information they display. Namely: 

• Subject field information 

• Verified organizational details 

• Subject alternative information (SAN) field information  

SSL Certificate Examples (Different Levels of Validation) 

SSL/TLS certificates come in three varieties: 

1. Domain Validation (DV) SSL Certificate 

This type of certificate is used to secure a single domain name (e.g., yourdomain.com). Here’s a domain validation SSL certificate example that shows what a user sees when they click on this type of certificate: 

Related resource: How to Complete DV Validation (Domain Validated SSL)

2. Organization Validation (OV) SSL Certificate 

This next example is for an organization validation (OV) SSL certificate. This type of certificate provides basic business validation — meaning that the issuing CA does some basic vetting of the business to check its legitimacy prior to issuing the certificate. Some of that information is then shared in the certificate details, as seen in the SSL certificate example below:  

Related resource: How to Complete OV Validation (Organization Validated SSL)

3. Extended Validation (EV) SSL Certificate 

Last, but certainly not least, is an extended validation certificate. This is the one that offers the highest level of validation of any SSL/TLS certificate. This is because the business requesting the certificate must undergo more stringent verification checks to ensure its legitimacy.    

Lastly, this is an example of an extended validation SSL/TLS certificate: 

Related resource: How to Complete EV Validation (Extended Validated SSL)

SSL Certificate Examples (Based on What They Allow You to Secure) 

Alright, now that we’ve seen the different validation levels, it’s also crucial to consider what the certificate will help you secure. For example: 

• A single domain name (standard SSL/TLS certificate) 

• Multiple unique domains (multi-domain SSL/TLS certificate) 

• First-level subdomains (wildcard SSL/TLS certificate) 

So, what does it look like when you see these in the wild? Well, you already saw a few examples of single-domain SSL/TLS certificates. But let’s quickly go through the list of other options to see what they look like… 

Wildcard SSL/TLS Certificate 

Here’s a basic (single domain) wildcard SSL certificate example: 

Multi-Domain SSL/TLS Certificate 

Looking for an example of a multi-domain SSL certificate? We’ve got you covered: 

How to Get an SSL/TLS Certificate 

Getting an SSL/TLS certificate is something that can be done relatively quickly:  

• Choose the certificate provider or certification authority you want to purchase an SSL/TLS certificate from (e.g., GeoTrust).  

• Generate and submit a certificate signing request (CSR) to the certificate provider or CA. (For GeoTrust users, you can do this easily through our GeoTrust Horizon dashboard.)  

• Complete the domain control validation (DCV) process and additional business validation requirements (for OV and EV certificates). 

• Download your certificate files from the GeoTrust Horizon dashboard. 

• Install the certificate files on your server and set your configurations as needed.   

If you’re looking for more detailed instructions, check out our related resource “How to Get an SSL Certificate for My Website.”