A digital certificate is a signed electronic record that binds a public key to a subject, like a server or user, under an issuer’s policy and validity period.

In identity and transport security, this usually means an X.509 public-key certificate. It lets another system evaluate a public key’s association with an expected identity. The certificate itself can be shared; the corresponding private key needs protection and is not part of the certificate.

What a digital certificate contains

A certificate identifies its issuer and includes the subject’s public key. It also carries a serial number, a validity period and extensions that can constrain its use. For a website, subject alternative names identify the hostnames the certificate covers.

The issuer’s digital signature protects this information against undetected changes. To accept a certificate, the receiving system checks the applicable identity and trust rules, including the certification path and permitted use. A readable certificate file is not evidence that these checks have passed.

CA, CSR and certificate issuance

A certificate authority (CA) issues certificates after the checks required by its policy. A certificate signing request (CSR) carries the public key and requested information to the issuer, commonly with a signature proving control of the corresponding private key.

The CA decides what information it will certify. Submitting a name in a CSR does not prove ownership of that name. Similarly, renewing a certificate needs an issuance process appropriate to the environment rather than blind acceptance of old assumptions.

For a customer portal, certificate deployment should be tied to service ownership. Someone must be responsible for renewal and for updating dependent systems when keys change. Otherwise a routine expiration can become a customer-facing outage.

Expiration, CRLs and OCSP

Expiration ends the certificate’s stated validity period. Revocation can withdraw trust earlier, for example when a private key is compromised.

A certificate revocation list (CRL) publishes identifiers of revoked certificates. The Online Certificate Status Protocol (OCSP) provides a way to request status information about a certificate. Support and checking behavior vary, so a team must understand how its actual clients enforce the chosen policy.

These mechanisms do not erase copies of a certificate or private key. Their purpose is to help relying systems decide whether the credential should still be accepted.

What the certificate proves

A valid certificate supports a defined key-to-subject association. During authentication, the holder also needs to prove control of the corresponding private key. Merely presenting a copied public certificate should not be enough to impersonate the holder.

A website certificate also does not certify that a business is honest or that every page is safe. It supports endpoint authentication within its validation model, not a general endorsement of the site’s behavior.

Frequently asked questions

Does a certificate contain the private key?

An X.509 public-key certificate contains the public key. A separate credential bundle may package a certificate together with a private key, which makes that bundle sensitive.

What is the difference between a CSR and a certificate?

A CSR asks an issuer to certify a public key and associated information. A certificate records what the issuer actually approved and signed.

Is an unexpired certificate always trustworthy?

No. Trust also depends on the issuer, the intended identity and use, and applicable status checks. Expiration is only one validation condition.

Related: Machine Identity · Credential Management · Authentication · API Security · Man-in-the-Middle Attack · Identity Lifecycle