When you open an https:// address, the browser first asks the server for its certificate. The certificate answers two questions: is this server really allowed to speak for this name, and which key should be used to encrypt the conversation.

The name SSL is old. Modern connections use TLS, the Transport Layer Security protocol. People still say "SSL certificate", and the two terms mean the same thing in daily use.

What is in a certificate

A certificate is a signed document. MDN describes it as binding the keys of a site to its domain name. Its main parts:

  • The names it is valid for, for example example.com and www.example.com.
  • The public key of the server.
  • The validity period: a start date and an end date. RFC 5280 calls them notBefore and notAfter, and the period includes both ends.
  • The issuer, the certificate authority that vouches for it.
  • A signature from the issuer, which lets a browser check that nothing was altered.

What it does

  • Identity. The browser checks that the certificate covers the name in the address bar and that a certificate authority it trusts has signed it.
  • Encryption. The public key lets the browser and the server agree on keys for an encrypted connection, so that others on the path cannot read or change what is sent.

The chain of trust

A server rarely presents a certificate signed directly by an authority the browser already knows. It presents its own certificate plus intermediate certificates that link it to a trusted root. RFC 5280 describes this as a certification path: the certificate of the site, plus zero or more certificates of authorities, leading to a trust anchor the user already holds. If one link is missing or invalid, the browser rejects the whole path.

Why certificates expire

Every certificate has an end date. A limited lifetime bounds how long a mistake or a stolen key stays useful. It also means certificates must be renewed. Renewal is often automated, and automation can fail without any visible sign. After the end date, browsers stop trusting the site and show a full-page warning, although nothing is wrong with the server. See How to Prevent SSL Certificate Expiration.

What a certificate does not prove

A valid certificate says that the connection is encrypted and that the name matches. It does not say that the site is honest, safe, or free of errors. It does not say that the application works.

SSL certificates in UptimeWire

For every website whose address starts with https://, UptimeWire opens a real secure connection every six hours. It checks the dates, the chain, and that the certificate covers the host name. A failing certificate, or one close to its end date, triggers a warning by email and Telegram. You choose how many days ahead for each website.

If the server cannot be reached, the result is shown as unknown rather than as a certificate failure. UptimeWire warns you. It does not renew or install certificates.