Beamfar
Sign inStart the 14-day trial

What is a TLS certificate (SSL certificate)?

Last updated .

A TLS certificate is a digitally signed file that links a website’s name to a public key, so that a browser can open an encrypted HTTPS connection and be confident it is talking to the right site. People still call it an SSL certificate, after the older protocol that TLS replaced.

Definition
TLS certificate
A signed file that ties a website name to a public key so browsers can trust an HTTPS connection, valid for a limited time.

What it contains

The names it covers (for example example.com and www.example.com), the public key, the issuer, the start and end dates of its validity and the issuer’s signature. A browser accepts it only if the name matches the address, the dates include today and the issuer’s signature chains up to a certificate authority it trusts.

Why it matters for a client site

A valid certificate is invisible. An expired or mismatched one stops the connection being trusted, and browsers show a full-page warning. Certificates now have maximum lifetimes that keep shrinking: 200 days from 15 March 2026, falling to 47 days by 2029, so renewal is frequent and mostly automated, which makes watching the result more important.

How to read one

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates prints the name, the issuer and the validity dates of the certificate a visitor would receive. Run it for each client’s main host, or let a monitor do it, and alert early enough to act: renewal fails most often after a DNS or hosting change, and with HSTS an expired certificate locks returning visitors out.

What to check

The expiry date, the hostnames covered, the issuer, whether the full chain is served and whether the certificate changed unexpectedly. See the guide on certificate expiry for a routine.

Sources

Read on . Standards and vendor pages change; confirm the current text before you rely on it.

Guides that use this term

  • Certificate authorityA certificate authority is an organisation browsers trust to issue TLS certificates after checking that the requester controls the domain. How validation and renewal work.
  • HSTSHSTS is a response header that tells browsers to use only HTTPS for a site. What max-age and includeSubDomains do, and why it turns an expired certificate into a hard failure.
  • Domain expiryDomain expiry is the date a domain registration ends unless renewed. What happens in the days after it, why reminders fail and how to monitor the date.

Know first. Know why. Tell your client before they call.

Paste your client list. Both regions start checking.

Start the 14-day trialWhat Beamfar watches

No card for the trial.