Security · interactive

Certificates and the chain of trust

Your browser trusts a few hundred root authorities. A site's certificate is trusted only if it links back to one of them through signatures, is in date, and names the site you asked for. Break one link and you get the red warning page.

https://shop.example.com

ISRG Root X1root
issued by ISRG Root X1 · valid until 2035-06-04
already in the browser's trust store
↓ signs
R11 (intermediate)intermediate
issued by ISRG Root X1 · valid until 2027-03-12
sent by the server
↓ signs
shop.example.comleaf
issued by R11 (intermediate) · valid until 2027-03-01
sent by the server

✓ Chains to a root in the trust store
Leaf ← R11 ← ISRG Root X1, which ships with the OS/browser.
✓ Each signature verifies
Each certificate is signed by the private key of the one above it.
✓ Within validity dates
Today is inside every certificate's validity window.
✓ Name matches shop.example.com
Listed in the Subject Alternative Name.

Connection is secure

Every link checks out: the leaf is signed by R11, R11 by a root the browser already trusts, dates are fine and the name matches.

Scenario

Step 1 of 4 · read left to right

1
A certificate binds a name to a key
It says “this public key belongs to shop.example.com”, signed by an authority that checked.
The server proves it has the private key in the TLS handshake.
2
Chains end at a trusted root
Roots sign intermediates (kept offline), intermediates sign site certificates. The server must send the intermediates.
openssl s_client -showcerts -connect host:443
3
Dates and names must match
Expired certificates and names missing from the Subject Alternative Name list are rejected.
Wildcards cover one label: *.example.com.
4
Automate renewal
Let's Encrypt certificates last 90 days (and are getting shorter). Use ACME clients or cert-manager, and alert well before expiry.
Expired certs still cause big outages.

In production

Tools and technologies

Every HTTPS connection validates a certificate chain.

Not tied to one language — use these names when you search docs or design a system.