Is there a security difference between free and paid certificates?

Not in terms of encryption; both use the same algorithms. The differences are commercial: validation level (DV, OV, EV), support and warranty.

What is a wildcard certificate?

It covers every direct subdomain of a name such as *.company.com with one certificate; it does not cover deeper levels (a.b.company.com).

Are the certificate and the private key the same thing?

No. The certificate is public and gets distributed; the private key stays on the server only. If the key leaks, the certificate must be revoked.

How do we find out how many certificates we have?

With a discovery tool that scans network ranges over TLS, then by linking every certificate in the inventory to the systems it is installed on.

Guide

What is an SSL/TLS certificate and how does it work?

Behind the padlock in the browser there is a certificate, a certificate authority and a chain of trust. This article covers what you need for everyday work.

12 August 2026 · 6 min read

What it does

A TLS certificate does two things: it proves that the server you are talking to really belongs to the domain it claims, and it carries the public key needed to encrypt the traffic.

Identity: The certificate binds a domain name (for example api.company.com) to a public key; a certificate authority signs that binding.
Encryption: Browser and server agree on a session key using the public key in the certificate; after that, traffic flows under symmetric encryption.
SSL or TLS?: SSL is the name of the old protocol; TLS is what is used today. The industry still says SSL certificate out of habit; it means a TLS server certificate.

What is inside a certificate

Domain names: The common name (CN) and the subject alternative name list (SAN): the domains the certificate is valid for. Modern browsers only look at the SAN list.
Public key: RSA (2048 or 4096 bit) or ECDSA (P-256, P-384). The private key stays on the server and is not part of the certificate.
Issuer and chain: The intermediate authority that signed the certificate and the root above it. The browser must be able to build the chain from the leaf up to a root it trusts.
Validity period: The start and end dates. Once it expires the certificate is invalid even if everything else in it is correct.
Fingerprint: The SHA-256 digest of the certificate. The most reliable way to tell two certificates for the same domain apart.
Serial number and revocation: A unique number assigned by the authority; revocation status is checked through CRL or OCSP.

Why browsers trust it

Trust does not come from the certificate itself but from the root list that browsers and operating systems ship.

Chrome, Safari, Firefox and Windows, macOS, Android and iOS each maintain a root store; only chains signed by those roots are trusted.
To get into the root stores, a certificate authority must follow the CA/Browser Forum rules (the Baseline Requirements) and pass an independent audit every year.
An authority that breaks the rules is removed from the stores; every certificate it issued turns into a browser error.
Certificates from an internal PKI are trusted only by devices that have that root installed; they cannot be used on public websites.

What happens when it expires

The browser shows a full-page warning; most users do not continue.
API calls and service-to-service connections fail with TLS errors; mobile apps and integrations stop.
When the certificate on a load balancer or reverse proxy expires, every service behind it is affected at once.
The usual cause is not knowing where a certificate is installed: it gets renewed in one place while the old version stays in three others.

The lifecycle

Issuance01
A key pair is generated; after domain validation the certificate authority signs the certificate. Automated through ACME or done by hand.
Installation02
The certificate, its chain and the private key are placed on the target system; the service is reloaded.
Verification03
A live TLS connection confirms the target really serves the new certificate.
Monitoring04
Remaining lifetime is tracked; an alert fires when the threshold is crossed.
Renewal05
A new version is obtained before expiry and the same steps repeat. From 2029 this cycle runs eight times a year for every certificate.
Revocation06
If the private key leaks, the authority is notified and the certificate is revoked; a new one replaces it.

Frequently asked questions

Is there a security difference between free and paid certificates?: Not in terms of encryption; both use the same algorithms. The differences are commercial: validation level (DV, OV, EV), support and warranty.
What is a wildcard certificate?: It covers every direct subdomain of a name such as *.company.com with one certificate; it does not cover deeper levels (a.b.company.com).
Are the certificate and the private key the same thing?: No. The certificate is public and gets distributed; the private key stays on the server only. If the key leaks, the certificate must be revoked.
How do we find out how many certificates we have?: With a discovery tool that scans network ranges over TLS, then by linking every certificate in the inventory to the systems it is installed on.

Sources

Manage your certificates in one place

Inventory, expiry tracking, renewal through ACME and verified installation, on your own infrastructure.

Request a demo