How does a certificate establish trust?

Identity before trust

Encryption does not identify the other side by itself.

TLS (Transport Layer Security) can protect data in transit, but the client still needs evidence that the service belongs to the requested name. A certificate binds an identity, such as a hostname, to a public key and includes a signature from an issuer.

The browser compares that evidence with its trust store, the requested hostname, and the certificate's validity period. A failure in one check can produce a warning even when the connection is encrypted.

Certificate trust

What is Public Key Infrastructure (PKI)?

A root certificate authority (CA) is trusted directly by the client through its trust store. It can authorize an intermediate CA, which can then issue a leaf certificate for a service such as api.example.com.

During a TLS connection, the browser checks the leaf certificate's hostname, dates, signature, and public-key proof, then follows the issuer signatures toward a trusted root. Trust in the chain does not mean the application itself is safe; it means the key is authorized for that identity.

Certificate lifecycle

Trust must be maintained after issuance.

A certificate has a limited validity period and must be renewed before it expires. An issuer may also revoke it early if a private key is compromised, a name is no longer controlled, or the certificate was issued incorrectly.

Clients can use revocation information such as certificate revocation lists or Online Certificate Status Protocol (OCSP) responses, depending on their policy and environment. A certificate that was valid yesterday is not automatically valid today.

Build the model

Four certificate checks