TLS and HTTPS: what a certificate proves

HTTPS is HTTP over a secure TLS connection. Its purpose is to protect the confidentiality and integrity of data in transit and help clients verify that they are connecting to the intended server.

How a secure connection begins

The client and server negotiate connection parameters, perform a cryptographic exchange, and establish keys for subsequent data transfer. The server presents a certificate, which the client checks against the hostname and a trusted chain of certificate authorities.

What the browser checks

Hostname. The certificate must match the domain the user is visiting.
Validity period. The certificate must not be expired or not yet valid.
Chain of trust. The certificate must chain to a trusted certificate authority or another chain explicitly trusted by the client.

HTTPS does not guarantee that a website’s content is safe or accurate. It protects transport and helps verify the domain connection; it does not assess the quality of information on a page.

Why certificate errors happen

Common causes include self-signed certificates, hostname mismatches, expired certificates, incomplete chains, and virtual host configuration mistakes. Any of these can trigger browser warnings or client failures.

Basic diagnostics

To inspect the certificate a server presents for a specific hostname, use OpenSSL:

openssl s_client -connect example.com:443 \
  -servername example.com </dev/null

Check the SAN hostnames, issuer, validity dates, and chain verification result. Automated renewal should monitor not only certificate issuance but also whether the server actually presents the new certificate.

Takeaway

Reliable HTTPS requires a valid certificate, a maintained TLS configuration, and regular checks. Security works best when it is understood and treated as part of routine operations.

← Back to all insights