Skip to content
Know.itKnow.it
Create an animated lesson
On request

This article is free to read. Creating a lesson uses your daily or stored credits; review the language and settings before starting.

How do SSL certificates work?

TechnologyLesson on requestFree to readयह पेज हिंदी में पढ़ें

Quick answer

SSL certificates work by using public-key cryptography to verify a website's identity and establish an encrypted connection. The website's owner obtains a certificate from a trusted authority, which signs it digitally. The browser checks this signature, then confirms the server holds the matching private key while both sides agree on a session key for encrypting all data.

An SSL certificate proves a website's identity and enables encrypted communication, so data sent between a browser and server cannot be read or altered by eavesdroppers. It works by combining public-key cryptography with a trusted third-party signature that verifies the certificate belongs to the site's owner.

Step by step

  1. The website owner creates a public-private key pair and keeps the private key secret.
  2. The owner sends a certificate signing request with the public key and domain name to a certificate authority.
  3. The authority verifies the owner's control of the domain and signs the certificate with its own private key.
  4. The browser receives the certificate, checks the authority's signature using a pre-installed public key, and confirms the domain matches.
  5. The server proves it holds the matching private key, and the two sides agree on a shared session key.
  6. All further communication is encrypted with the session key, protecting data from eavesdroppers.

Key things to understand

  1. A website owner generates a key pair: a public key shared openly and a private key kept secret.
  2. The owner sends the public key and domain details to a certificate authority (CA) for validation.
  3. The CA verifies domain ownership and signs the certificate with its own private key.
  4. The browser checks the CA's signature using the CA's public key, which is pre-installed in the browser or operating system.
  5. Once trusted, the server proves it holds the matching private key, and both sides agree on a shared session key that encrypts all traffic.

Labelled diagram

  1. Key pair

    Website owner generates a public key and a secret private key.

  2. CA validation

    Certificate authority checks that the owner controls the domain.

  3. Certificate issued

    CA signs the certificate with its own private key.

  4. Browser check

    Browser verifies the CA's signature using a trusted public key.

  5. Secure session

    Browser and server agree on a shared key for encryption.

How an SSL certificate builds trust

Real-world examples

  • When you visit your bank's website, the SSL certificate ensures your login details are encrypted and the site is genuine.
  • Online retailers like Amazon use SSL certificates to protect credit card information during checkout.
  • Google's Gmail uses SSL/TLS to encrypt emails between your browser and its servers.
  • A small blog can get a free SSL certificate from Let's Encrypt, making HTTPS available to everyone.

Common mistake

✗ Myth: An SSL certificate makes a website completely secure and trustworthy.

✓ Fact: An SSL certificate only proves that the connection is encrypted and that the site's domain matches the certificate. It does not guarantee the website's content is safe or that the business is honest. A phishing site can also have a valid certificate.

People also ask

What is an SSL certificate?
An SSL certificate is a digital file that binds a public key to a website's identity, such as its domain name. It is issued by a trusted certificate authority after verifying domain ownership. It enables encrypted connections and helps browsers confirm they are talking to the real website, not an imposter.
How does SSL encryption work?
SSL encryption uses a combination of public-key and symmetric-key cryptography. First, the server proves its identity with its certificate and private key while both sides agree on a shared session key. Then all data is encrypted with that session key, which is much faster. This protects data in transit from being read or modified.
Why do SSL certificates expire?
SSL certificates expire to limit the risk if a private key is compromised and to ensure website owners regularly re-verify their identity. Expiration dates are typically one year or less. When a certificate expires, browsers show warnings, prompting renewal and keeping the trust system current.
What is the difference between HTTP and HTTPS?
HTTP sends data in plain text, so anyone on the network can read it. HTTPS uses SSL/TLS encryption to scramble the data, and it also verifies the website's identity with a certificate. The padlock icon in your browser indicates HTTPS is active.
How does my browser know which certificate authorities to trust?
Browsers and operating systems come with a pre-installed list of trusted root certificates from major certificate authorities. When a website presents a certificate, the browser checks if it was signed by one of these trusted roots, either directly or through a chain of intermediate certificates.
Can an SSL certificate be forged or stolen?
Forging a certificate is extremely difficult because it requires the CA's private key, which is heavily guarded. Stealing a website's private key would allow an attacker to impersonate the site, but certificates can be revoked, and browsers check revocation lists. Proper key management is essential.
Do SSL certificates expire? Why?
Yes, certificates have an expiration date, typically one year or less. Expiration limits the damage if a private key is compromised and forces website owners to renew and re-verify their identity regularly. Browsers warn users when a certificate is expired.

Part of the guide: How the Internet Works →