SSL and TLS — Certificates and Trust
At midnight every browser starts showing "Your connection is not private" for notes.example.com. No code changed. The certificate simply expired. Understanding what a certificate proves, and automating its renewal, prevents one of the most common outages there is.
The rule
TLS encrypts the connection, and a trusted certificate proves who is at the other end.
TLS (Transport Layer Security) protects a connection in three ways: encryption so nobody can read it, integrity so nobody can alter it unnoticed, and authentication so you know you reached the real server. SSL is the name of its older predecessor; every SSL version and early TLS versions are now considered insecure, and servers should offer only TLS 1.2 and 1.3. People still say "SSL certificate" out of habit.
A certificate binds a public key to one or more domain names, with validity dates, and is signed by a certificate authority (CA). Your browser or operating system ships a list of trusted root CAs. The server sends its certificate plus any intermediate certificates, forming a chain from the site up to a trusted root.
The browser checks three things: is the chain signed by a root it trusts, does the name match the host it asked for, and is today inside the validity dates?
Certificates are deliberately short-lived, measured in months at most, and getting shorter. Free CAs such as Let's Encrypt are designed for automatic renewal with a client such as certbot, which renews well before expiry.
openssl s_client -connect notes.example.com:443 -servername notes.example.com </dev/null
openssl s_client -connect notes.example.com:443 -servername notes.example.com </dev/null 2>/dev/null \
| openssl x509 -noout -subject -issuer -datesThe shortcut
Any certificate error is one of three checks: trust, name, date. Read the error, decide which check failed, and the fix follows.
Expired
Today is after
notAfter. That is a date failure: renew, then automate renewal so it cannot happen again.
The trap: "fixing" a certificate error by turning off verification in a script (curl -k, verify=False). That removes the authentication, the part that stops someone impersonating your server.
Drills
Answer fast — trust the rule.
Which protocol versions should a modern server offer?
Who signs a website's certificate so browsers trust it?
Users visiting notes.example.com see a name mismatch error. Which check failed?
A script fails with a certificate verification error. What is the wrong fix?
Remember
- TLS encrypts the connection, and a trusted certificate proves who is at the other end.
- Shortcut: every certificate error is trust, name or date.
- Trap: manual renewals, and turning verification off.