Certificate

As explained in Real-World Cryptography

A digital certificate is a signed data structure that binds an identity or domain name to a public key.

When a browser connects to google.com, it must distinguish the real server from an impostor. A certificate helps by binding a domain name to a public key through a certificate authority’s signature. section 9.2.1

A browser evaluates a website certificate through a trust chain:

• The server sends a certificate chain beginning with its leaf certificate, which contains the website’s public key and domain metadata. section 9.2.1
• Each certificate is signed by the certificate above it; the chain ends at a root certificate already trusted in the browser or operating system trust store. section 9.2.1
• A certificate authority issues the certificate after the website owner proves control of the domain, such as by hosting a requested file. section 9.2.1
• Trust can still fail if a certificate authority misbehaves; controlled clients may instead use a private PKI or pin a certificate or public key. section 9.3

Inspecting a certificate

A browser’s certificate viewer can show a chain such as GlobalSign root CA → GTS intermediate CA → Google leaf certificate for *.google.com. OpenSSL can display the issuer, validity period, subject, signature algorithm, and public-key information. section 9.2.1

Figure 9.6 The authentication part of a handshake starts with the server sending a certificate chain to the client. The certificate chain starts with the leaf certificate (the certificate containing the website’s public key and additional metadata like the domain name) and ends with a root certificate that is trusted by the browser. Each certificate contains a signature from the certificate above it in the chain.

Trace how the leaf certificate, intermediate certificates, and trusted root form the authentication chain sent during a TLS handshake. section 9.2.1

How Real-World Cryptography covers it

How deep it goes

Explains issuance, trust chains, certificate contents, encodings, inspection, and CA failure risks without implementation-level validation details.

Examples

Uses Google’s certificate chain, Chrome’s Certificate Viewer, OpenSSL output, domain-validation files, and PEM-encoded certificate data.

What it assumes

Assumes public keys and digital signatures, while reintroducing public key infrastructure through website authentication.

What you can do after

Evaluate/understand how browsers authenticate domains and inspect certificate chains, fields, formats, and trust relationships.

How it connects

Connects certificates to TLS handshakes, web PKI, certificate authorities, digital signatures, trust stores, and certificate revocation.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  ASP.NET Core in Action, 3eAn HTTPS certificate is a digital certificate used to authenticate a server and enable encrypted HTTPS communication.
• 

  liveBookmanning.com
  Acing the Certified Kubernetes Administrator Exam, Second EditionA certificate is a digitally signed credential used to establish identity and support authenticated communication.
• 

  liveBookmanning.com
  Building Web APIs with ASP.NET CoreA TLS certificate is a digitally signed credential that binds an identity to a public key for authenticated encrypted connections.
• 

  liveBookmanning.com
  Build Python Web Apps with StreamlitA digital certificate is a digitally signed document that binds a domain or other identity to a public key for authentication and encrypted communication.
• 

  liveBookmanning.com
  Hacking CryptographyA digital certificate is a signed data structure that binds a public key to an identified subject and related metadata.
• 

  liveBookmanning.com
  WordPress Power Toolkit: Harness AI to build next-level websitesA certificate is a credential issued to recognize completion of a course or fulfillment of specified learning requirements.
• 

  liveBookmanning.com
  100 SQL Server Mistakes and How to Avoid ThemA certificate is a cryptographic object containing a public key and identity information that can support encryption or authentication.
• 

  liveBookmanning.com
  Data Pipelines with Apache Airflow, Second EditionA digital certificate is a signed data structure that binds an identity to a public key and includes information for validating that binding.
• 

  liveBookmanning.com
  Logs and TelemetryA digital certificate is a signed credential that binds an identity to a public key for authenticated communication.
• 

  liveBookmanning.com
  Kubernetes for DevelopersA TLS certificate is a digital certificate that authenticates a network endpoint and supports Transport Layer Security connections.
• 

  liveBookmanning.com
  Learn Docker in a Month of Lunches, Second EditionA digital certificate binds a domain identity to a cryptographic public key for authenticating a network endpoint.
• 

  liveBookmanning.com
  Google Anthos in ActionA certificate is a digitally signed credential that binds an identity to a public key or other authenticated information.
• 

  liveBookmanning.com
  .NET in Action, Second EditionA certificate is a digitally signed credential that binds an identity to a public key for establishing authenticated secure connections.
• 

  liveBookmanning.com
  Authorization in ActionA digital certificate is a signed data record that binds an identity or domain name to a public key.

Compare how 15 books explain certificate →

Related concepts

• certification authorityproduced by · A certification authority is a trusted entity that verifies identities and issues digitally signed certificates binding public keys to identities or domains.
• public keyhas part · A public key is the openly distributable component of an asymmetric cryptographic key pair, used for encryption, authentication, or signature verification.
• self-signed certificateincludes · A self-signed certificate is a digital certificate whose signature is created by the same entity and key identified by the certificate rather than by a certificate authority.
• TLSused by · Transport Layer Security (TLS) is a cryptographic protocol that protects network communications through confidentiality, integrity, and authentication of communicating endpoints.
• mutual TLSused by · Mutual TLS is a Transport Layer Security configuration in which both communicating endpoints authenticate each other using digital certificates.
• public-key infrastructureused by · Public-key infrastructure is a framework of authorities, certificates, keys, policies, and procedures for establishing and managing public-key trust and digital identities.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.