SSL Certificate Glossary

ACME (Automated Certificate Management Environment) is a protocol that automates the process of issuing, renewing, and managing SSL certificates, eliminating the need for manual intervention.

BEAST (Browser Exploit Against SSL/TLS) is a security vulnerability disclosed in 2011 that exploited weaknesses in the cipher block chaining (CBC) mode implementation in SSL 3.0 and TLS 1.0. This attack allowed attackers to decrypt encrypted HTTPS traffic by exploiting predictable initialization vectors in the CBC encryption mode, potentially exposing sensitive information like session cookies and authentication credentials.

An entity that issues and manages SSL certificates

An SSL certificate chain, also called a chain of trust, links your website's certificate to a root certificate that browsers already trust. It's made up of three parts: your server's certificate, one or more intermediate certificates, and a root certificate. Each certificate is signed by the one above it, so a browser can follow the chain up and confirm the whole thing is legitimate.

Certificate Chain Validation is the process of verifying that an SSL/TLS certificate is authentic and trustworthy by checking its complete chain of trust back to a recognized Certificate Authority (CA). This validation ensures that each certificate in the chain is properly signed by its issuer and that the entire chain leads to a trusted root certificate installed in the client''s trust store.

The Certificate Expiration Date indicates the exact timestamp when an SSL/TLS certificate will cease to be valid and trusted by browsers and other client applications. After this date, the certificate enters an expired state and will trigger security warnings, potentially blocking access to the secured website or service.

The Certificate Issue Date represents the exact timestamp when the Certificate Authority (CA) digitally signed and issued the SSL/TLS certificate. This date marks the beginning of the certificate''s validity period and indicates when the certificate became active and ready for use in securing communications.

The automated process of handling SSL certificates from start to finish (CLM), like having a personal assistant that manages all certificate tasks.

Teaching your mobile app or website to only trust specific SSL certificates, like only accepting packages from trusted delivery services.

The process of invalidating a certificate before its expiration date

Certificate Revocation List (CRL) Status indicates whether an SSL/TLS certificate has been checked against the Certificate Authority''s revocation list and shows the current revocation status of the certificate. CRLs are digitally signed lists published by Certificate Authorities that contain the serial numbers of certificates that have been revoked before their natural expiration date.

The current validity state of an SSL certificate

Certificate Time Remaining represents the duration left before an SSL/TLS certificate expires, typically displayed in days, hours, or minutes depending on proximity to expiration. This metric provides a real-time countdown that helps administrators prioritize certificate renewals and avoid service disruptions caused by expired certificates.

A public logging system that monitors certificate issuance

Certificate Transparency Log Entries represent the specific records and metadata associated with a certificate''s inclusion in public Certificate Transparency logs. These entries provide detailed information about when, where, and how a certificate was logged, creating an immutable audit trail that enhances the security and transparency of the PKI ecosystem.

Certificate Transparency (CT) Log Status indicates whether an SSL/TLS certificate has been properly submitted to and recorded in public Certificate Transparency logs. CT is a security mechanism that creates publicly auditable records of all issued certificates, helping detect misissued or malicious certificates that could be used for attacks against encrypted communications.

Certificate Validation Type refers to the level of identity verification performed by a Certificate Authority (CA) before issuing an SSL/TLS certificate. This verification process determines how thoroughly the CA validates the certificate applicant''s identity and authority over the domain, with different validation types offering varying levels of assurance and trust.

The set of cryptographic algorithms used for the connection

The primary domain name this certificate is issued for

The Current SSL/TLS Protocol refers to the specific version of the SSL/TLS protocol that was negotiated and is actively being used for the secure connection. This represents the agreed-upon protocol version between the client and server after the TLS handshake process, which may differ from the maximum protocol version supported by either party.

Basic validation that confirms domain ownership

An End Entity Certificate, also known as a server certificate or leaf certificate, is the final certificate in the SSL/TLS certificate chain that is directly bound to the specific server, domain, or service being secured. This certificate contains the public key used for encrypting communications and the identity information that browsers and other clients use to verify they are connecting to the intended server.

The highest level of validation with rigorous identity verification

A complete domain name that precisely identifies a server''s location in the DNS hierarchy, essential for SSL certificate validation.

A brief window after certificate expiration when some systems might still accept the certificate, though this creates security risks.

A security mechanism that forces browsers to always use the secure HTTPS version of a website, protecting against downgrade attacks.

HTTPS stands for Hypertext Transfer Protocol Secure, which is the secure version of HTTP, the protocol browsers use to load web pages. When you visit a website over HTTPS, the data exchanged between your browser and the server is encrypted. This encryption protects sensitive information, like passwords, credit card numbers, and personal details, from being intercepted or altered by unauthorized parties.

A certificate that sits between the root and end-entity certificates

A certificate that secures an IP address instead of a domain name

The traditional Internet Protocol that has been the backbone of internet communications and SSL certificate deployment for decades.

The latest version of Internet Protocol that provides expanded address space and improved security features for SSL certificates.

Ultra-short-lived SSL certificates designed specifically for IPv6 infrastructure with 6-day validity periods, pioneered by Let''s Encrypt for enhanced security.

The Certificate Authority that issued this certificate

A certificate storage format specifically designed for Java applications to securely store SSL certificates and private keys.

The public key algorithm used in this certificate

The Last Checked timestamp indicates when the SSL/TLS certificate''s status and properties were most recently verified by the monitoring system. This timestamp is crucial for understanding the freshness of certificate data and ensuring that any changes or issues with the certificate are detected promptly.

A security protocol where both client and server authenticate each other using certificates, providing bidirectional trust verification.

Mozilla''s security toolkit that handles SSL certificates and encryption, powering Firefox and many other applications'' security features.

Online Certificate Status Protocol for real-time certificate validation

OCSP (Online Certificate Status Protocol) Status provides real-time information about whether an SSL/TLS certificate has been revoked by its issuing Certificate Authority. Unlike Certificate Revocation Lists (CRLs) which are downloaded periodically, OCSP allows clients to query the CA''s OCSP responder in real-time to check the current status of a specific certificate.

OpenSSL is a free, open-source cryptography toolkit that powers SSL and TLS across most of the internet. It includes a library used by web servers and other software, and a command-line tool developers use to inspect, generate, and verify certificates and keys.

Validation that confirms both domain ownership and organization identity

A security property that protects past communications if private keys are compromised

The entire trust system that makes SSL certificates work, like a network of official agencies that create, manage, and verify digital certificates.

POODLE (Padding Oracle On Downgraded Legacy Encryption) is a critical security vulnerability discovered in 2014 that exploits weaknesses in SSL 3.0''s padding validation mechanism. This attack allows attackers to decrypt encrypted HTTPS traffic by forcing connections to downgrade from modern TLS versions to the vulnerable SSL 3.0 protocol, then exploiting the protocol''s flawed padding implementation.

Port 443 is the default network port that web servers use to deliver HTTPS traffic, the secure version of web communication. Just as a physical address directs you to a specific building, a port directs internet traffic to the correct service on a server. When your browser loads a secure website using HTTPS, it connects to the server via Port 443.

A visual barcode containing SSL certificate information that allows mobile devices to quickly verify website security status.

The top-level certificate in the trust hierarchy

A certificate that can secure multiple specific domain names

A Self-Signed Certificate is an SSL/TLS certificate that is signed by the same entity that the certificate identifies, rather than by a trusted Certificate Authority (CA). In essence, the private key used to sign the certificate belongs to the same entity that the certificate represents, creating a certificate that vouches for its own authenticity.

Unique identifier for this certificate

The cryptographic algorithm used to sign this certificate

Allows multiple websites with different SSL certificates to share the same server address, like having multiple businesses operate from the same building.

SSL (Secure Sockets Layer) is a cryptographic protocol originally developed by Netscape in the 1990s to provide secure communication over computer networks, particularly the internet. Although SSL has been superseded by TLS (Transport Layer Security), the term ''SSL'' is still commonly used to refer to both SSL and TLS protocols, and SSL certificates are universally called ''SSL certificates'' even when they actually use TLS.

Security protocols that encrypt communications over networks

Additional domain names covered by this certificate

Supported SSL/TLS Protocols represent the complete list of protocol versions that a server is configured to accept and negotiate with connecting clients. This configuration determines which clients can successfully establish secure connections and influences both security posture and compatibility with older systems.

TLS (Transport Layer Security) is the modern cryptographic protocol that replaced SSL (Secure Sockets Layer) to provide secure communication over computer networks. Developed by the Internet Engineering Task Force (IETF), TLS is the current standard for encrypting data transmitted between web browsers and servers, ensuring privacy, data integrity, and authentication for internet communications.

The process of establishing a secure connection between client and server

A certificate extension that identifies resources by their web address rather than just domain names, useful for specialized applications.

A security audit that identifies weaknesses, outdated settings, or configuration problems in SSL certificate implementations.

A certificate that secures a domain and all its subdomains

The international standard that defines how SSL certificates are structured and what information they must contain.

A security model that requires verification for every access attempt, making SSL certificates crucial for continuous authentication and encryption.