When a browser connects to a website, a certificate helps verify that the server is the legitimate owner of the requested domain rather than an impersonator. section 3.2
A certificate cryptographically links a server’s domain name to its public key. Trusted Certificate Authorities issue certificates, and browsers verify them before establishing a confidential TLS connection. section 3.2
Treat the browser lock as evidence with limits:
- Check the domain name as well as the lock; a deceptive name such as twitter.com.info can still have a valid certificate. section 3.2
- Account for misconfiguration, expired Certificate Authorities, and man-in-the-middle attacks when assessing TLS trust. section 3.2














